posthog-automation
Warn
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the user to add an external MCP server endpoint (https://rube.app/mcp). This endpoint provides the tool definitions and handles the execution of PostHog operations. The domain rube.app is not associated with the author sickn33 nor is it on the trusted vendors list.
- [PROMPT_INJECTION]: The skill processes data from PostHog which presents an indirect prompt injection surface.
- Ingestion points: Data enters the agent context through tools like POSTHOG_LIST_AND_FILTER_PROJECT_EVENTS (project events) and POSTHOG_RETRIEVE_FEATURE_FLAG_DETAILS (feature flag configuration).
- Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore embedded commands within the retrieved PostHog data.
- Capability inventory: The skill can perform network operations via the MCP server and modify project states through tool sequences like POSTHOG_CAPTURE_EVENT and POSTHOG_CREATE_FEATURE_FLAGS_FOR_PROJECT.
- Sanitization: There is no documented validation or sanitization of content retrieved from the PostHog API before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill executes a variety of tools via the Rube MCP server to interact with the PostHog API, including capturing events, managing feature flags, and retrieving project metadata, which could be exploited if the underlying MCP server is compromised.
Audit Metadata