Posthog CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:19 AM UTC
• Version: 1.0.0

Overview

This PostHog CLI skill is not clearly malicious, but it gives agents broad write and delete authority over analytics resources with weak guardrails.

Review this skill before installing. Use it only with narrowly scoped PostHog credentials, prefer read-only operations unless you explicitly intend to change production resources, avoid copying --yes delete commands into agent workflows, and verify any self-hosted PostHog hostname before authenticating.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

" ``` - Publish a lock file or requirements file that pins all transitive dependencies. - Provide cryptographic hashes and require hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` - Verify that the package artifact is produced from the stated source repository using signed tags, attestations, or trusted build provenance. - Re-audit the dependency whenever the pinned version changes. - Recommend installation into an isolated virtual environment rather than the system Python environment. - Avoid elevated installation privileges and grant the PostHog API key only the minimum permissions required for the intended operation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/commands.md:31

Finding

Authentication Example Uses an Inconsistent External Hostname

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The raw API escape hatch allows arbitrary endpoint access, including delete operations with user-supplied paths and data. In an agent environment, this creates a powerful parameter-abuse surface where prompt-driven input could be turned into unintended destructive API calls against PostHog resources.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

posthog api get /path/ posthog api post /path/ --data '{"key": "value"}' posthog api patch /path/ --data '{"key": "value"}' posthog api delete /path/

text

## Error Handling

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The raw API escape hatch allows arbitrary project-scoped GET/POST/PATCH/DELETE requests, effectively bypassing any safety boundaries implied by higher-level commands. In an agent context, this is particularly dangerous because it enables unbounded mutation of analytics configuration and data-adjacent resources with minimal guardrails, making misuse or prompt-induced abuse much easier.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The raw API delete example is especially risky because it combines arbitrary endpoint targeting with a --yes destructive pattern and no safety messaging. This materially increases the chance of severe unintended changes or deletions across project resources, especially when used by an autonomous or semi-autonomous agent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description is broad enough to trigger on generic analytics or product-health questions, which can cause the agent to invoke a terminal-integrated skill when the user did not explicitly ask to use PostHog or a CLI. That increases the chance of unnecessary access to analytics data or execution of commands in contexts where a safer, non-tool response would suffice.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The instruction to 'Always use' --yes for non-interactive automation encourages bypassing confirmation prompts across all commands, including destructive or high-impact ones. In an autonomous agent context, this removes an important safety barrier and makes accidental or unauthorized changes significantly easier.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

Use with ANY command:

- `--json` / `-j` — Machine-readable JSON output. **Always use this when parsing output programmatically.**
- `--yes` / `-y` — Skip confirmation prompts. **Always use this for non-interactive automation.**
- `--help` — Show help for any command.

## Quick Reference

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation prominently includes create, update, patch, and delete-style operations without adjacent warnings that these commands change production analytics configuration and project state. In an agent setting, examples can be treated as acceptable actions, increasing the risk that the agent performs impactful changes without clear user confirmation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Feature Flag Rollout

bash

posthog flag create --key new-feature --name "New Feature" --rollout-percentage 10
posthog flag update <id> --rollout-percentage 50
posthog flag update <id> --rollout-percentage 100

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The command reference exposes broad state-changing capabilities including create, update, launch, stop, and delete operations across flags, experiments, surveys, dashboards, insights, and raw API calls, which exceeds a narrowly analytics/read-oriented skill framing. This increases the chance an agent will take destructive or configuration-changing actions under the guise of analytics assistance, especially because the documentation presents these commands as normal usage without narrowing conditions or approval requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented posthog --yes flag delete <flag-id> example demonstrates irreversible deletion while also bypassing confirmation, yet provides no warning to the operator. In an agent-driven workflow, this raises the risk of accidental or induced deletion of feature flags that can affect product behavior and rollout controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The experiment deletion example presents a destructive action without warning about permanence or operational consequences. Deleting experiment records can remove important historical context and can be triggered too easily by an agent or user following examples verbatim.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The survey deletion example uses --yes to bypass confirmation and lacks any caution about permanent removal. Because surveys may be customer-facing artifacts and associated reporting may be operationally important, an agent could cause unintended loss with a single command copied from the reference.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The dashboard deletion command is shown as a routine example without warning that the action is irreversible. In practice, dashboards often represent curated operational views, so deleting them can disrupt analytics workflows and shared visibility across teams.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The insight deletion example lacks a safety warning despite being a destructive action that may remove saved analytical work. In an agent setting, terse examples can be treated as endorsed actions, increasing the likelihood of accidental deletion of valuable queries or reports.

Content

No source excerpt is available for this finding.