exploring-llm-traces
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze raw AI agent traces (including prompts, outputs, and tool states) from PostHog. Because this data originates from external agent interactions, it represents a surface for indirect prompt injection where malicious instructions embedded in a trace could attempt to influence the analyzing agent.
- Ingestion points: Untrusted trace data is retrieved via
posthog:query-llm-traceandposthog:query-llm-traces-list(SKILL.md). - Boundary markers: The skill does not define specific delimiters or safety instructions to isolate trace content from the agent's instruction context.
- Capability inventory: The agent has access to
posthog:execute-sqland local script execution (python3) to process retrieved data. - Sanitization: No evidence of sanitization or filtering of trace content is present before the agent processes the data.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local Python scripts (
scripts/print_summary.py,scripts/extract_conversation.py, etc.) to parse and summarize JSON trace data that is too large for the context window. It also leverages theposthog:execute-sqltool for ad-hoc analysis of observability data. These tools are functionally appropriate for the skill's purpose of debugging complex AI traces.
Audit Metadata