posthog-debugger
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites, creating a surface for potential indirect prompt injection where a site could attempt to influence the agent's behavior.\n
- Ingestion points: The skill reads page titles, accessibility trees, and console logs using
mcp__chrome-devtools__take_snapshot,mcp__chrome-devtools__list_console_messages, andmcp__playwright__browser_snapshotas defined inSKILL.md.\n - Boundary markers: There are no explicit delimiters or instructions to ignore instructions found within the processed website content or logs.\n
- Capability inventory: The agent has the ability to navigate to arbitrary URLs, list network requests, and execute JavaScript via
evaluate_scripttools inSKILL.md.\n - Sanitization: The skill does not implement specific sanitization or filtering for website-provided text before processing.\n- [DYNAMIC_EXECUTION]: The skill uses browser automation to execute JavaScript snippets on the global state of target websites. While the code templates are defined within the skill, they interact directly with the runtime environment of untrusted websites.\n
- Evidence: Use of
mcp__chrome-devtools__evaluate_scriptandmcp__playwright__browser_evaluateinSKILL.mdto run custom diagnostic code in the browser context.
Audit Metadata