The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session data, including tool calls and intents, which are ingested from external agent runs. This content represents a potential surface for indirect prompt injection if the source data contains malicious instructions intended to manipulate the agent's behavior during analysis.
Ingestion points: Data is ingested in SKILL.md via the posthog:mcp-analytics-sessions-list and posthog:mcp-analytics-sessions-tool-calls tools.
Boundary markers: The instructions do not specify the use of delimiters or boundary markers when the agent processes the retrieved session history.
Capability inventory: The skill has the capability to execute arbitrary SQL via posthog:execute-sql and access event properties across the PostHog environment.
Sanitization: There are no explicit instructions for sanitizing or escaping the session content before it is presented to the agent for summarization or investigation.
[DATA_EXPOSURE]: The tool facilitates access to sensitive user metadata, specifically person_email and distinct_id, as part of the session listing workflow. This behavior is consistent with the primary purpose of a PostHog analytics skill and is managed through official vendor tools.

exploring-mcp-sessions