working-with-autoresearch
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied configurations such as 'target_event', 'target_definition', and 'training_population' (references/defining-a-question.md) to generate feature SQL and predictive models. While this is the intended functionality of the Autoresearch feature, it represents an indirect injection surface if untrusted data is provided in these definitions. The skill relies on the platform's sandbox environment for execution.
- Ingestion points: User-provided target and population definitions in SKILL.md and references/defining-a-question.md.
- Boundary markers: None explicitly mentioned in the instructions for user input.
- Capability inventory: Uses
posthog:execute-sql,posthog:autoresearch-create, andposthog:autoresearch-train-createacross all reference files. - Sanitization: The skill text does not specify sanitization for user-supplied SQL or event names.
- [COMMAND_EXECUTION]: The skill uses the
posthog:execute-sqltool (SKILL.md, references/using-predictions.md) to perform complex data analysis and retrieve prediction scores. This is a powerful capability within the PostHog environment used for its primary purpose of data analysis.
Audit Metadata