feature-usage-feed

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of an automated pipeline that ingests and processes untrusted user data.
  • Ingestion points: The skill processes $ai_generation events (LLM traces) in SKILL.md (Step 2) and Step 4, which contain raw user inputs and model outputs from production sessions.
  • Boundary markers: The LLM-judge prompt template defined in SKILL.md (Step 3) lacks explicit boundary markers or instructions to ignore embedded commands within the trace data being analyzed.
  • Capability inventory: The skill defines a workflow to create an LLM evaluation (posthog:llma-evaluation-create) and a Slack dispatch mechanism (Step 6) that posts these summaries to an external channel.
  • Sanitization: There is no mention of sanitizing or escaping the $ai_evaluation_reasoning field before it is interpolated into the Slack Block Kit template (Step 6.3).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 03:21 PM
Security Audit — agent-trust-hub — feature-usage-feed