experiment-audit

SUSPICIOUS. The core PostHog audit behavior is coherent and data flows are mostly local and proportionate, but the skill also directs local command execution and durable logging through env-controlled paths and an unverifiable external redactor/wrapper. That is not enough to call it malicious, but it raises medium trust and privacy risk around the surrounding support tooling rather than the PostHog audit itself.