instrument-metrics
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The agent is instructed to use standard deployment tools such as
helm installfor Kubernetes environments to deploy the official PostHog metrics agent from the vendor's OCI registry. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official vendor libraries including
posthog-nodevia npm and theposthogPython package via pip from standard public registries. - [SAFE]: The skill implements secure credential management by explicitly advising against hardcoding project tokens and instead utilizing environment variables or an authenticated Model Context Protocol (MCP) tool for configuration.
- [INDIRECT_PROMPT_INJECTION]: While the skill ingests project configuration files (e.g.,
package.json,requirements.txt) as a surface for platform detection, it does so within the context of standard developer tooling provided by the vendor, with no evidence of malicious redirection.
Audit Metadata