feature-usage-feed
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to set up a pipeline that analyzes untrusted trace data containing user inputs using an LLM judge. This configuration is susceptible to indirect prompt injection, where malicious instructions hidden in user traces could manipulate the output sent to Slack.
- Ingestion points: Untrusted trace data is ingested through the
posthog:query-llm-traces-listtool as described in Step 2 of SKILL.md. - Boundary markers: The prompt template for the LLM judge in Step 3 lacks robust boundary markers or explicit instructions to treat trace content as untrusted data or ignore embedded instructions.
- Capability inventory: The skill uses tools like
posthog:llma-evaluation-createandposthog:llma-evaluation-runto establish an AI analysis process and relies on PostHog Slack workflows for distribution as detailed in SKILL.md. - Sanitization: No explicit sanitization, validation, or filtering logic is described for the raw interaction traces before they are evaluated by the AI judge.
Audit Metadata