skills/posthog/ai-plugin/skills-store/Socket

skills-store

Warn

Audited by Socket on Apr 23, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The skill’s capabilities match its purpose and its network/data flow stays within PostHog, so it is not malware-like. The main risk is architectural: it instructs the agent to load remote shared skill bodies/files and treat them as instructions, creating meaningful indirect prompt-injection and transitive-trust risk.

Confidence: 89%Severity: 64%

Audit Metadata

Analyzed At

Apr 23, 2026, 04:21 PM

Package URL

pkg:socket/skills-sh/posthog%2Fai-plugin%2Fskills-store%2F@6ac8e5268e2322b7248c1e03da0857a9093fab21