feature-usage-feed
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of an automated pipeline that ingests and processes untrusted user data.
- Ingestion points: The skill processes
$ai_generationevents (LLM traces) inSKILL.md(Step 2) and Step 4, which contain raw user inputs and model outputs from production sessions. - Boundary markers: The LLM-judge prompt template defined in
SKILL.md(Step 3) lacks explicit boundary markers or instructions to ignore embedded commands within the trace data being analyzed. - Capability inventory: The skill defines a workflow to create an LLM evaluation (
posthog:llma-evaluation-create) and a Slack dispatch mechanism (Step 6) that posts these summaries to an external channel. - Sanitization: There is no mention of sanitizing or escaping the
$ai_evaluation_reasoningfield before it is interpolated into the Slack Block Kit template (Step 6.3).
Audit Metadata