exploring-llm-evaluations
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill enables the creation and dry-running of "Hog" source code via
posthog:llma-evaluation-createandposthog:llma-evaluation-test-hog. This code is executed within the PostHog ingestion pipeline to evaluate events. While this is the core intended purpose of the skill, it creates a surface for dynamic script execution. - [COMMAND_EXECUTION]: The tool
posthog:execute-sqlallows for the execution of arbitrary HogQL/SQL queries against the project's ClickHouse database for investigative purposes. - [INDIRECT_PROMPT_INJECTION]: The skill processes AI generation data, which often contains untrusted user messages and model responses, exposing an indirect prompt injection surface.
- Ingestion points: Generation data enters the agent context through
posthog:query-llm-traceandposthog:llma-evaluation-runas described in the workflows inSKILL.md. - Boundary markers: Absent. The skill does not define specific delimiters or "ignore previous instruction" wrappers for the content being evaluated.
- Capability inventory: The skill possesses the ability to execute database queries (
posthog:execute-sql) and run/test custom scripts (posthog:llma-evaluation-test-hog). - Sanitization: Absent. There is no evidence of filtering or sanitizing event properties before they are passed into evaluation prompts or Hog code logic.
Audit Metadata