The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for the agent to install PostHog SDKs and official integrations from standard package registries such as PyPI, NPM, and NuGet. It also recommends using the vendor's setup wizard via npx @posthog/wizard, which involves downloading and executing a utility from PostHog's official infrastructure.
[COMMAND_EXECUTION]: To implement the requested observability, the agent is instructed to run discovery commands to identify the project's LLM provider and execute installation commands for various telemetry libraries and dependencies.
[DATA_EXFILTRATION]: The skill's primary function is to capture and transmit AI-related telemetry to PostHog's analytics servers (posthog.com). This includes potentially sensitive data such as model input prompts and generated responses, which is the intended behavior for an AI observability platform.
[CREDENTIALS_UNSAFE]: The skill uses the projects-get MCP tool to retrieve project-specific API tokens. It follows secure development practices by explicitly instructing the agent to save these tokens into environment variable files (e.g., .env) rather than embedding them directly into source code.
[INDIRECT_PROMPT_INJECTION]: By instrumenting LLM calls to capture prompt and response content, the skill defines a surface area where untrusted user data is transmitted to a third-party observability platform. The provided instrumentation logic does not include explicit sanitization or filtering for the captured prompt data, which is a characteristic risk of monitoring systems in LLM applications. (Ingestion: LLM calls; Capability: Data capture and transmission to PostHog; Sanitization: Absent).

instrument-llm-analytics