The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents the ph.agent.request(prompt) capability, which allows the canvas application to send natural language prompts back to the authoring agent. This creates a surface for indirect prompt injection if untrusted data retrieved from PostHog (such as task titles from system.tasks, comment text, or user-defined ph.state entries) is interpolated into the prompt string without adequate sanitization or boundary markers.
Ingestion points: Data enters the context via ph.query (PostHog insights, system tables) and ph.state.get (persistent storage).
Boundary markers: The skill does not explicitly provide instructions for using delimiters or boundary markers when constructing strings for ph.agent.request.
Capability inventory: The ph bridge supports ph.agent.request (agent interaction), ph.actions.invoke (data writes), and ph.navigate (navigation).
Sanitization: The instructions do not specify sanitization or escaping requirements for data passed to the agent request API.
Mitigation: The reference documentation notes that the platform host displays the exact prompt to the viewer and requires manual approval before dispatching the request to the agent.

querying-canvas-data