error-tracking-nextjs
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for capturing application errors and parsing browser cookies into the PostHog platform. This creates a data ingestion surface where external, untrusted content (such as error messages or cookie payloads) could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points:
posthog.captureException(error)and cookie parsing in theonRequestErrorhook withinreferences/nextjs.md. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are present in the provided implementation templates.
- Capability inventory: The skill facilitates network transmission of captured data to vendor-owned API endpoints.
- Sanitization: No specific sanitization or filtering logic is included in the implementation examples.
- [EXTERNAL_DOWNLOADS]: The documentation guides the installation of
posthog-jsandposthog-nodepackages from standard Node.js registries. These are official libraries provided by the skill's author. - [CREDENTIALS_UNSAFE]: The skill promotes secure handling of sensitive information by instructing users to utilize environment variables (
.env.local) for project tokens and host URLs, explicitly advising against hardcoding these values.
Audit Metadata