posthog-automation

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and connects to an external MCP server at https://rube.app/mcp and links to documentation on composio.dev. Both resources belong to Composio, an established service provider for AI agent toolkits.
  • [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection (Category 8) based on its ingestion of untrusted data from the PostHog API.
  • Ingestion points: Data enters the context via tools like POSTHOG_LIST_AND_FILTER_PROJECT_EVENTS and POSTHOG_RETRIEVE_FEATURE_FLAG_DETAILS which retrieve event data and configurations from PostHog.
  • Boundary markers: The skill body lacks instructions or delimiters to isolate retrieved data or prevent the agent from following instructions embedded within that data.
  • Capability inventory: The skill allows the agent to perform write operations including POSTHOG_CAPTURE_EVENT and POSTHOG_CREATE_FEATURE_FLAGS_FOR_PROJECT (as defined in SKILL.md).
  • Sanitization: No validation or sanitization of the external data is specified before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 04:24 PM
Security Audit — agent-trust-hub — posthog-automation