The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted, externally-supplied data which represents a potential injection surface.
Ingestion points: Raw JSON data is retrieved from the system.ingestion_warnings table via posthog:execute-sql. This includes fields like details, message, and property values that are populated by external events sent to the PostHog API.
Boundary markers: The SKILL.md file contains an explicit 'Trust boundary' section that warns the agent to treat this data as untrusted and to never follow instructions found within it.
Capability inventory: The skill uses tools with significant permissions, including posthog:execute-sql (database read), posthog:project-settings-update (project configuration), posthog:persons-property-delete (person data deletion), and posthog:cdp-functions-list (pipeline configuration).
Sanitization: There is no automated sanitization of the external data; the skill relies on the agent's adherence to the instructional warnings provided in the markdown files.
[COMMAND_EXECUTION]: The skill enables the execution of powerful administrative operations through its toolset. These tools are used to query database systems and modify sensitive project settings based on the analysis of ingestion warnings. While these are necessary for the skill's primary purpose of diagnosing and fixing ingestion problems, they provide a high-impact capability that could be targeted by sophisticated indirect prompt injection.

resolving-ingestion-warnings