posthog-automation
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and connects to an external MCP server at
https://rube.app/mcpand links to documentation oncomposio.dev. Both resources belong to Composio, an established service provider for AI agent toolkits. - [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection (Category 8) based on its ingestion of untrusted data from the PostHog API.
- Ingestion points: Data enters the context via tools like
POSTHOG_LIST_AND_FILTER_PROJECT_EVENTSandPOSTHOG_RETRIEVE_FEATURE_FLAG_DETAILSwhich retrieve event data and configurations from PostHog. - Boundary markers: The skill body lacks instructions or delimiters to isolate retrieved data or prevent the agent from following instructions embedded within that data.
- Capability inventory: The skill allows the agent to perform write operations including
POSTHOG_CAPTURE_EVENTandPOSTHOG_CREATE_FEATURE_FLAGS_FOR_PROJECT(as defined inSKILL.md). - Sanitization: No validation or sanitization of the external data is specified before it is processed by the agent.
Audit Metadata