Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Posthog Analytics
v1.2.0Automate PostHog dashboard creation, sync, update, and export via API. Covers dashboard CRUD, insight creation, cohort management, and API-driven analytics w...
⭐ 0· 80·0 current·0 all-time
bySolomon Neas@solomonneas
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and included Bash script implement PostHog dashboard/insight create/sync/update/export via the PostHog API, which matches the skill name and description. However, registry metadata lists no required environment variables or primary credential while the SKILL.md and script require POSTHOG_PERSONAL_API_KEY — this mismatch is unexpected and should be corrected.
Instruction Scope
Runtime instructions and the script are narrowly scoped to: read a JSON config, call the PostHog API (host configurable via POSTHOG_HOST), create/update/export dashboards/insights, and write the dashboard_id back to the provided config file. The instructions do not reference unrelated system files, other credentials, or external endpoints outside the configured PostHog hosts.
Install Mechanism
No install spec is provided (instruction-only). The script depends on standard tools (curl, jq, bash). No downloads or archive extraction are performed by the skill itself.
Credentials
The script and SKILL.md require POSTHOG_PERSONAL_API_KEY (with read/write access) and optional POSTHOG_HOST/POSTHOG_UI_HOST. Registry metadata (as reported) declares no required env vars or primary credential — this is a discrepancy. The required API key is appropriate for the described functionality, but the missing declaration in the registry is a red flag and should be fixed so installers know what sensitive credential will be used.
Persistence & Privilege
The skill does not request permanent installation privileges (always:false). The script modifies only the config file you pass it (it writes dashboard_id back into that file via a safe tmp file). It does not change other skills, global agent config, or request elevated system privileges.
What to consider before installing
This skill appears to do what it claims (manage PostHog dashboards) and the included script is readable and scoped. However: (1) the registry metadata failing to declare POSTHOG_PERSONAL_API_KEY and the primary credential is an inconsistency — confirm the registry/author lists the API key as required before installing. (2) Review the script locally before running and run it with a minimal-permission PostHog API key (only the org/project needed), and avoid running as root. (3) jq and curl are required; ensure they come from trusted sources. (4) Note the script will update the JSON config file you pass (it writes dashboard_id back into it); keep backups if needed. (5) If you have any doubt about the source (homepage unknown, source unknown), consider testing in a disposable project or environment first and rotate the API key after initial use.Like a lobster shell, security has layers — review code before you run it.
latestvk97dy4rvawmjwafzvqmavmpm4d83b2v1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Environment variables
POSTHOG_PERSONAL_API_KEYrequired— PostHog personal API key with read/write accessPOSTHOG_HOSToptional— PostHog API host (EU: eu.i.posthog.com)POSTHOG_UI_HOSToptional— PostHog UI host for dashboard URLs