exploring-mcp-tool-usage
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructional documentation and routing logic for official PostHog analytics tools. It does not contain any evidence of prompt injection, malicious obfuscation, persistence mechanisms, or unauthorized privilege escalation. All referenced tools (e.g.,
posthog:query-mcp-tool-stats,posthog:execute-sql) are legitimate platform capabilities provided by the author. - [INDIRECT_PROMPT_INJECTION]: The skill functions by analyzing external telemetry and event data, which constitutes a potential surface for indirect prompt injection.
- Ingestion points: As described in
SKILL.md, the skill ingests data from the$mcp_tool_callevent stream, including agent intents, error messages, and registered tool descriptions. - Boundary markers: The routing skill does not explicitly define delimiters or instructions to ignore embedded commands within the analyzed data, relying on the underlying agent's core safety protocols.
- Capability inventory: The skill utilizes specialized analytics tools and a dynamic SQL execution tool (
posthog:execute-sql) to process and display event data. - Sanitization: No explicit sanitization or validation of the event content is mentioned in the routing instructions. However, as these capabilities are central to the skill's primary purpose of analytics, this finding is considered low-risk and does not escalate the overall verdict.
Audit Metadata