The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automates the installation of the PostHog SDK and related integration packages for multiple languages and frameworks. Detected packages include vendor-owned libraries like posthog, @posthog/ai, posthog-node, and PostHog.AI, as well as well-known AI libraries such as openai, anthropic, langchain, and litellm. These downloads are from official registries (npm, PyPI, NuGet, etc.) and are consistent with the skill's purpose.
[COMMAND_EXECUTION]: The skill executes shell commands to install dependencies via package managers (e.g., pip install, npm install, dotnet add package). It also references the npx @posthog/wizard ai-observability command, which is a vendor-provided tool for automated instrumentation. Additionally, it utilizes the PostHog MCP server's projects-get tool to securely retrieve project API tokens.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes codebase files and instruments LLM calls.
Ingestion points: Reads codebase dependency files and source code (SKILL.md STEP 1, STEP 4).
Boundary markers: Instrumentation follows standard SDK patterns provided in reference files.
Capability inventory: The skill has the ability to write to files (SKILL.md STEP 4, STEP 6), install dependencies (STEP 3), and initiate network operations through the installed analytics SDKs.
Sanitization: The skill explicitly instructs the agent to use environment variables for keys and to make minimal, targeted code additions to maintain application stability.
[SAFE]: All identified network endpoints (e.g., posthog.com, us.i.posthog.com, eu.i.posthog.com) and GitHub repositories belong to the verified author posthog or established AI providers. The skill's behavior aligns perfectly with its stated mission of adding observability features.

instrument-llm-analytics