modeling-warehouse-foundations
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies and documents a vulnerability surface where the agent processes untrusted data from the PostHog capture API and data catalog.
- Ingestion points: Event names, action names, property values, and metric descriptions or instructions stored in
system.information_schema.metricsare identified as potentially attacker-controlled (SKILL.md, references/governance.md). - Boundary markers: The skill contains explicit instructions for the agent to treat this data as 'quoted' and 'untrusted project data,' emphasizing it should not be interpreted as instructions or authorizations (references/governance.md).
- Capability inventory: The agent has access to powerful tools for data manipulation and code execution, including
posthog:view-create,posthog:view-materialize,posthog:execute-sql,posthog:view-update, andposthog:view-delete(references/posthog-views.md). - Sanitization: The instructions require the agent to confirm the specific events and properties with the human user before any persistent write operations like creating or materializing views (SKILL.md).
Audit Metadata