The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection because it reads and processes external codebase files at runtime to plan its operations (Step 1, 5, and 6 in SKILL.md).
Ingestion points: The agent reads project dependency files (e.g., package.json, Gemfile, requirements.txt), lockfiles, and application source code to detect platforms and existing tracking logic.
Boundary markers: The skill does not define specific delimiters or instructional guards to differentiate project code from its own operational instructions when reading files.
Capability inventory: The skill is granted extensive permissions, including writing files, executing shell commands for installation and linting (Step 3, 10), and accessing environment variables through the PostHog MCP server (Step 9).
Sanitization: There is no evidence of content sanitization or filtering applied to the codebase data before it enters the agent's context.
[COMMAND_EXECUTION]: The skill requires shell access to manage dependencies and verify implementation quality.
Development Tooling: It executes package managers (npm, pnpm, yarn, pip, composer, etc.) to install vendor SDKs and runs project-specific linter or Prettier scripts defined in package.json (Step 10).
[EXTERNAL_DOWNLOADS]: The skill downloads official PostHog SDK packages and dependencies from established public repositories like NPM, PyPI, and Maven Central as part of the integration process.
[OBFUSCATION]: The skill's reference documentation (e.g., references/astro.md, EXAMPLE-astro-view-transitions.md) includes minified JavaScript snippets for initializing the PostHog web client. These snippets are the standard, vendor-provided method for SDK initialization and do not represent malicious obfuscation.

instrument-product-analytics