wizard-development
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of documentation and architectural principles for developers working on the PostHog wizard codebase. It defines clear boundaries between infrastructure and product knowledge.
- [SAFE]: The architecture includes multiple security layers: an instruction-based layer (commandments), a tool-use allowlist (canUseTool), and a rule-based scanner (warlock) that uses YARA-X rules to detect sensitive data or dangerous operations.
- [SAFE]: The skill describes a 'secret vault' mechanism designed specifically to prevent credentials and sensitive user input from ever entering the LLM's conversation context, using opaque references instead.
- [EXTERNAL_DOWNLOADS]: The documentation mentions fetching skill packages from official GitHub release assets and utilizing remote MCP servers (such as mcp.posthog.com and mcp.svelte.dev) for legitimate integration tasks.
Audit Metadata