The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data originating from external sources (error logs, user session events, and AI-generated summaries) which could contain malicious instructions intended to manipulate the agent's logic or output.
Ingestion points: Untrusted data enters the agent context through posthog:execute-sql (capturing $current_url and $exception_fingerprint from user events), posthog:query-error-tracking-issue (capturing issue name and description), and posthog:vision-observations-list (reading model_output from previous AI scans).
Boundary markers: The instructions do not define delimiters or specific warnings to ignore embedded instructions within the ingested session data or external metadata.
Capability inventory: The skill has access to posthog:execute-sql for database querying, posthog:session-recording-get for full data retrieval, and posthog:vision-scanners-scan-session for invoking AI-powered analysis.
Sanitization: There is no mention of sanitizing, escaping, or validating the URLs or issue descriptions before they are presented to the user or used in subsequent logic.

finding-replay-for-issue