instrument-product-analytics
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs expected analytics instrumentation tasks using official SDKs provided by the author (PostHog).
- [EXTERNAL_DOWNLOADS]: Installs official PostHog SDKs from public package registries (npm, PyPI, etc.) according to the detected project framework.
- [COMMAND_EXECUTION]: Executes package manager commands to install dependencies and run project validation scripts as needed for instrumentation.
- [DATA_EXFILTRATION]: Transmits telemetry and user identity data to PostHog endpoints. This is the core functionality of the skill and is explicitly disclosed.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface.
- Ingestion points: The skill reads 10 to 15 project source files (SKILL.md) to plan event tracking.
- Boundary markers: Absent; no specific delimiters or warnings are used when the agent processes file contents.
- Capability inventory: The agent can install packages, write to source files, and send captured data to the PostHog API.
- Sanitization: Absent; the skill does not filter or sanitize code content before using it to influence agent behavior.
Audit Metadata