instrument-integration
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads official PostHog packages from standard registries (NPM, PyPI, Maven, Rubygems, CocoaPods, SPM) which are recognized as official distribution channels for a well-known service provider.
- [DATA_EXPOSURE]: Documentation examples and code snippets use clear placeholders for project tokens and correctly advise against hardcoding secrets, recommending standard environment variables and secrets managers for secure handling.
- [DYNAMIC_EXECUTION]: Certain documentation examples utilize standard library dynamic imports in Python (e.g.,
__import__("datetime")) for reporting utilities, which is a benign use of language features in the provided context. - [INDIRECT_PROMPT_INJECTION]: The skill's initialization workflow involves reading project configuration files (such as
package.jsonorpubspec.yaml) to detect platforms. While this represents a data ingestion surface, the risk is negligible as it is part of the intended primary developer utility of the skill.
Audit Metadata