The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection (Category 8).
Ingestion points: The agent is instructed to read and analyze the user's codebase, including dependency files and multiple source files, to plan instrumentation (SKILL.md, Steps 1 and 5).
Boundary markers: Absent. There are no instructions to use specific delimiters or to disregard instructions found within the code or comments of the analyzed files.
Capability inventory: The agent has the capability to write to local files (Steps 4, 6, 7, 8, 9) and execute shell commands for package installation and project verification (Steps 3, 10).
Sanitization: Content from the analyzed codebase is not explicitly sanitized before being incorporated into the agent's workflow.
[CREDENTIALS_UNSAFE]: A specific PostHog project token is hardcoded within the documentation reference files.
Evidence: The string phc_jE9kXU0depRekiuabVROlxxkIXn95NqsNO3qB4qNKtl is included in references/EXAMPLE-swift.md as an environment variable. While this is a public-facing project key used for data ingestion, hardcoding specific tokens in reference implementations is a violation of security best practices.
[COMMAND_EXECUTION]: The skill performs arbitrary command execution for dependency management and project verification.
Evidence: The agent uses package managers to install the PostHog SDK (Step 3) and is instructed to run linter or build scripts found in the project's configuration (Step 10).
[EXTERNAL_DOWNLOADS]: The skill downloads and installs dependencies from a remote registry.
Evidence: The agent installs official PostHog SDKs (e.g., posthog-js, posthog-node, posthog-python) using standard package managers (Step 3). These resources originate from a well-known service provider.

instrument-product-analytics