skills-store
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external instructions and files from a remote PostHog repository and explicitly directs the agent to treat the fetched content as system-level instructions.
- Ingestion points: External content is loaded into the agent context via the posthog:skill-get tool (fetching the instruction body) and posthog:skill-file-get tool (fetching bundled assets) as described in SKILL.md.
- Capability inventory: The agent is instructed to follow the fetched 'body' as its primary instructions, which allows the remote content to potentially drive the agent to perform file system operations, command execution, or network requests using its enabled tools.
- Boundary markers: The skill does not implement or recommend specific delimiters or safety prompts to isolate the fetched instructions from the agent's core safety constraints.
- Sanitization: No mechanism is provided to validate, sanitize, or verify the integrity of the instructions or files retrieved from the remote PostHog store before they are processed by the agent.
Audit Metadata