feature-usage-feed
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of LLM traces generated by production users. Malicious users could craft inputs to the features being monitored (e.g., session summaries or AI search) that are designed to manipulate the LLM-judge evaluation instructions defined in Step 3.
- Ingestion points: Raw trace content from
$ai_generationevents is ingested into the agent's context in Step 2 (posthog:query-llm-traces-list) and processed by the LLM-judge during dry-runs in Step 4 and at runtime in Step 6. - Boundary markers: The prompt template provided in Step 3 lacks explicit delimiters (like
[BEGIN TRACE DATA]) or instructions to the model to ignore any instructions embedded within the trace data itself. - Capability inventory: The skill uses
posthog:execute-sqlfor data verification,posthog:llma-evaluation-runfor execution, and sets up a Slack dispatch workflow that could be used to broadcast injected content to internal communication channels. - Sanitization: There is no mention of filtering, escaping, or sanitizing the trace input before it is interpolated into the evaluation prompt.
Audit Metadata