posthog

Warn

Audited by Socket on Mar 14, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS. The skill's operations generally match its stated PostHog purpose, and the CLI install path is a normal npm-based workflow. However, all PostHog access is routed through Membrane's third-party CLI/service and proxy rather than official PostHog APIs, so analytics data and delegated credentials flow through an intermediary. This is a coherent integration pattern but increases security and privacy risk beyond a direct PostHog connector.

Confidence: 86%Severity: 63%
Audit Metadata
Analyzed At
Mar 14, 2026, 10:06 PM
Package URL
pkg:socket/skills-sh/membranedev%2Fapplication-skills%2Fposthog%2F@1006182e7e715ad4ff7bf9cbbf625beeac93f2fd