querying-posthog-data
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions create a surface for indirect prompt injection by directing the agent to ingest and process data from PostHog entities like events and person properties, which are externally controlled. The agent is further instructed to use powerful tools like SQL and shell commands to explore this data.
- Ingestion points: Data is ingested through tools like
posthog:execute-sqland various read-data-schema functions in SKILL.md and references/guidelines.md. - Boundary markers: The guidelines recommend dumping large outputs to files for exploration, which provides a technical boundary but does not isolate instructions within the data.
- Capability inventory: The agent can execute complex HogQL/SQL via
posthog:execute-sqland is prompted to use bash commands for data analysis in references/guidelines.md. - Sanitization: No explicit sanitization or instructions to ignore embedded directives are provided.
Audit Metadata