authoring-log-alerts
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (scripts/baseline_stats.py) and a Python one-liner by piping JSON data into them via the shell. This involves interpolating data retrieved from PostHog tools directly into shell command strings. Evidence:
echo '<count-ranges JSON>' | python3 scripts/baseline_stats.py --window-minutes 5in SKILL.md andpython3 -c "import sys, json; d=json.load(sys.stdin); ..." < stats.jsonin references/volume-floor-alerts.md. - [DYNAMIC_EXECUTION]: The skill utilizes a Python one-liner and a local script to perform runtime calculations on data retrieved from external tools. The output of these calculations directly informs the parameters used in subsequent tool calls for alert creation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes log data from PostHog services, creating a surface for indirect injection if malicious content within the logs could influence the agent's behavior or alert configuration. \n
- Ingestion points: Log data is retrieved via posthog:logs-services and posthog:logs-count-ranges in SKILL.md. \n
- Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are present for the ingested log data. \n
- Capability inventory: The skill can create alerts and notification destinations (Slack, Teams, Webhooks) via posthog:logs-alerts-create and posthog:logs-alerts-destinations-create, and executes local code via python3. \n
- Sanitization: The provided script scripts/baseline_stats.py performs structural validation by parsing the input as JSON and extracting specific numeric fields.
Audit Metadata