instrument-integration
Warn
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: A hardcoded PostHog project token was discovered within a reference configuration file.
- File:
references/EXAMPLE-swift.md(within theBurritoConsiderationClient.xcschemecode block). - Evidence: The environment variable
POSTHOG_PROJECT_TOKENis explicitly set tophc_jE9kXU0depRekiuabVROlxxkIXn95NqsNO3qB4qNKtl. Although project tokens are client-side identifiers, they should be treated as placeholders in integration examples to prevent the unintentional use of specific project identities. - [COMMAND_EXECUTION]: The skill facilitates the execution of system commands for dependency management and project verification.
- Evidence: Step 3 and Step 7 of the instructions in
SKILL.mddirect the agent to use package managers (such asnpm,pip,bundle,composer, andgo) to install SDKs and run project scripts like linters. - [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of official PostHog integration libraries from public package registries.
- Evidence: Installation steps for official vendor resources including
posthog-js,posthog-node,posthog-python, andposthog-react-nativeare standard throughout the reference materials.
Audit Metadata