api-flags-posthog-flags
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and code examples prioritize security and reliability.
- [DATA_EXPOSURE_AND_EXFILTRATION]: No hardcoded secrets were found. The skill correctly instructs developers to use environment variables for sensitive API keys (
POSTHOG_API_KEY,POSTHOG_FEATURE_FLAGS_KEY) and explicitly warns that the secure API key (phs_*) must never be exposed on the client. - [REMOTE_CODE_EXECUTION]: No unauthorized remote code execution or script downloads are present. The skill utilizes official and well-known libraries (
posthog-jsandposthog-node) as intended. - [OBFUSCATION]: No obfuscation, multi-layer encoding, homoglyphs, or hidden characters were detected in any of the skill files.
- [INDIRECT_PROMPT_INJECTION]: The skill describes ingesting remote configuration data via JSON payloads from PostHog. This is a standard feature flagging workflow and is documented safely, using standard React data binding which provides built-in escaping.
- [DYNAMIC_EXECUTION]: The server-side examples include standard JSON parsing of cached data from Redis, which is a routine and safe practice for the described architecture.
Audit Metadata