querying-posthog-data
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface when reading governed metrics from the data catalog. It provides clear defensive instructions to the agent, specifying that any markdown content found in the semantic layer should be treated as untrusted data rather than executable instructions.
- Ingestion points: The agent retrieves markdown-based metric definitions via the
posthog:metric-describetool. - Boundary markers: The skill explicitly commands the agent to maintain its system prompt boundaries and ignore instructions embedded in the metric definitions.
- Capability inventory: The agent has access to SQL execution, tool invocation, and file system writes.
- Sanitization: The skill instructs the agent to manually perform described calculations while disregarding any embedded prompts to call tools or override safety guidelines.
- [DATA_EXFILTRATION]: The skill includes robust guidelines to prevent the accidental exposure of sensitive or large datasets.
- It instructs the agent to never dump full property objects or large JSON blobs (like AI trace inputs/outputs) directly into the conversation.
- It recommends using local file storage and bash-based exploration for large query results to maintain performance and prevent data leakage.
Audit Metadata