The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session metadata, including tool names, error messages, and intents that originate from external MCP clients. These fields are potentially attacker-controlled and could contain malicious instructions designed to influence the agent's summarization or data analysis workflow.
Ingestion points: The tools posthog:mcp-analytics-sessions-list and posthog:mcp-analytics-sessions-tool-calls retrieve fields like tool_name, error_message, and $mcp_intent into the agent's context.
Boundary markers: The skill lacks explicit instructions for the agent to treat these data fields as untrusted or to ignore any embedded instructions.
Capability inventory: The agent has access to posthog:execute-sql, which allows it to query and interact with the data based on the instructions it receives or generates.
Sanitization: There is no evidence of sanitization or filtering for the external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on posthog:execute-sql for advanced data analysis and to bypass feature flag restrictions. While this is consistent with the skill's primary purpose of exploring analytics, it provides a powerful capability for database interaction that could be abused if the agent is successfully injected.

exploring-mcp-sessions