The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of bundled scripts (phq.py, site-scan.sh, version-check.sh) to perform its primary functions. These scripts are executed via the agent's shell, and phq.py dynamically constructs curl commands using values passed from the agent's context.
[REMOTE_CODE_EXECUTION]: In scripts/site-scan.sh, the skill fetches configuration data from a host and token extracted from the target's website and pipes the output directly to python3 -m json.tool. While specifically invoking the JSON formatting module, piping data from a potentially untrusted remote host to a local interpreter is a high-risk pattern.
[EXTERNAL_DOWNLOADS]: The scripts/version-check.sh script performs an external request to raw.githubusercontent.com/PostHog/skills to check for updates. As this targets a vendor-controlled repository, it is documented as a neutral finding.
[DATA_EXFILTRATION]: The skill is designed to extract sensitive customer information, including CRM notes from Vitally, meeting transcripts from Gong, and raw event data from PostHog. This data is then synthesized and presented in the agent's chat. While this is the intended purpose of the skill, the handling of such sensitive data represents a significant security responsibility.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources, such as HTML from target websites, customer conversation bodies, and Gong transcripts.
Ingestion points: scripts/site-scan.sh (HTML), vitally.messages (CRM notes), Gong API (transcripts).
Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings for most external data ingestion.
Capability inventory: The agent has access to file system writes (scratchpads), network operations (via scripts), and shell command execution.
Sanitization: No explicit sanitization logic is present for the data interpolated into final prompts.

posthog-customer-deep-dive