The Agent Skills Directory

[COMMAND_EXECUTION]: The wrapper script scripts/posthog-cli executes a binary using a hardcoded absolute path pointing to a specific user's home directory: /home/lamrin/.cache/uv/archive-v0/Hj__dDMjU1XU-7V8sJzvv/bin/mcp2cli. Executing binaries from user-specific cache directories is a high-risk pattern that can lead to execution of untrusted or pre-seeded malicious code.
[EXTERNAL_DOWNLOADS]: The skill depends on an external binary mcp2cli that is not included in the skill source. The script assumes this binary exists within a specific uv cache folder, implying it was downloaded from a remote registry.
[CREDENTIALS_UNSAFE]: The skill documentation instructs users to manually export the sensitive POSTHOG_TOKEN into their shell environment. This exposes the raw secret to any process with environment access and stores it in the user's shell history.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection from PostHog data.
Ingestion points: Data fetched from PostHog APIs, including documentation (docs-search), event logs (logs-query), and analytics results.
Boundary markers: The skill does not implement delimiters or system instructions to ignore instructions embedded in the external data.
Capability inventory: The skill can perform state-changing operations such as deleting insights, updating feature flags, and creating dashboards.
Sanitization: No evidence of output sanitization or validation is present in the wrapper script.

posthog-cli