posthog

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains examples that embed API keys and a Bearer Authorization header directly in code and curl commands (e.g., literal phc_/phx_ keys and curl -H "Authorization: Bearer ..."), which would require the model to place secret values verbatim into outputs and thus creates an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md and reference files explicitly instruct the agent to call external PostHog endpoints (e.g., /decide, /api/projects/:id/*, feature flag payloads, survey responses and events) and to query project data via the private API, which will ingest and have the agent read user-generated/untrusted content (events, persons, survey freeform text, flag payloads) that can materially influence behavior such as feature-flag-driven logic—creating a clear pathway for indirect prompt injection.