The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from PostHog events and person properties through SQL queries. It also allows the agent to ingest free-text "suggestions" via the posthog:autoresearch-suggestions-create tool, which are then passed to an autonomous training agent.
Ingestion points: posthog:execute-sql reads event and person data from the database; posthog:autoresearch-suggestions-create takes user-provided prompts (suggestions) to steer the model.
Boundary markers: Absent. The instructions do not specify the use of delimiters or warnings to ignore embedded instructions when processing event data or user suggestions.
Capability inventory: The skill possesses the ability to execute SQL (posthog:execute-sql), trigger model training runs (posthog:autoresearch-train-create), and modify person properties (posthog:autoresearch-partial-update).
Sanitization: Absent. There is no mention of sanitizing or validating the ingested event data or the text suggestions before they reach the LLM-driven training agent.
[DYNAMIC_EXECUTION]: The skill describes a workflow where an "agent-driven predictive model" (a training agent) runs in a PostHog sandbox to write feature SQL and model code. This represents a dynamic execution attack surface where the generated code is derived from and operates on untrusted event data and schemas.
[COMMAND_EXECUTION]: The skill relies on the posthog:execute-sql tool to perform operations such as querying the autoresearch_prediction events and calculating score spreads. This tool allows for the execution of arbitrary SQL commands, which represents a significant capability for data access and manipulation within the PostHog environment.

working-with-autoresearch