The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and follow calculations described in a 'Data Catalog' (system.information_schema.metrics), which may contain MarkdownDefinition fields. The skill correctly identifies this as untrusted, project-authored data and provides specific defensive instructions to prevent the agent from obeying embedded malicious commands.
Ingestion points: posthog:metric-describe returns instructions from the data catalog which are authored by users of the PostHog project.
Boundary markers: The skill provides instructional boundaries (line 48 in SKILL.md), warning the agent to treat the text as data and not as commands.
Capability inventory: The agent has access to several database query tools (posthog:execute-sql, posthog:data-catalog-metric-run) and information retrieval tools.
Sanitization: The skill relies on natural language instructions to the agent rather than automated sanitization of the markdown content.
[COMMAND_EXECUTION]: The skill repeatedly advises the agent to dump large query results to files and use 'bash commands' to explore them. While this is intended for data volume management, it notes an interface between database outputs and a shell environment, which could be exploited if the shell tool is misused to execute data-derived strings.

querying-posthog-data