wizard-development

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill consists of documentation and architectural principles for developers working on the PostHog wizard codebase. It defines clear boundaries between infrastructure and product knowledge.
  • [SAFE]: The architecture includes multiple security layers: an instruction-based layer (commandments), a tool-use allowlist (canUseTool), and a rule-based scanner (warlock) that uses YARA-X rules to detect sensitive data or dangerous operations.
  • [SAFE]: The skill describes a 'secret vault' mechanism designed specifically to prevent credentials and sensitive user input from ever entering the LLM's conversation context, using opaque references instead.
  • [EXTERNAL_DOWNLOADS]: The documentation mentions fetching skill packages from official GitHub release assets and utilizing remote MCP servers (such as mcp.posthog.com and mcp.svelte.dev) for legitimate integration tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 10:15 PM
Security Audit — agent-trust-hub — wizard-development