Is posthog safe?
https://clawhub.ai/simonfunk/posthog
This PostHog API skill is a legitimate analytics integration wrapper with no malicious intent detected. The primary risks are: (1) JSON injection in the create-annotation command due to unescaped string interpolation, (2) potential credential theft if POSTHOG_HOST env vars are overridden by a malicious actor, and (3) the powerful HogQL query interface that could inadvertently expose PII from analytics data. No prompt injection, canary file access, or suspicious clone-time behavior was observed.
Category Scores
Findings (6)
MEDIUM JSON injection in create-annotation command -12 ▶
The create-annotation command in posthog.sh directly interpolates user-supplied arguments ($1 and $2) into a JSON string using double quotes without escaping. If the content or date_marker contains double quotes or backslashes, this breaks the JSON structure and could lead to malformed requests or unexpected behavior.
MEDIUM Env var host override enables credential theft -18 ▶
POSTHOG_HOST and POSTHOG_INGEST_HOST environment variables are trusted without any validation. If an attacker can set these variables (via another skill, .env file manipulation, or shell profile modification), all API requests including Bearer tokens and project API keys would be sent to an attacker-controlled server.
LOW Powerful HogQL query access to analytics data -10 ▶
The query endpoint provides SQL-like access to events, persons, sessions, and groups tables. An agent executing queries on behalf of a user could inadvertently expose PII (email addresses, user properties, session recordings) in its output context, which could then be visible to other skills or logged.
LOW Overly broad skill activation keywords -10 ▶
The skill description includes many generic trigger phrases that could cause unintended skill activation when the user mentions analytics-related terms in unrelated contexts.
INFO Capture endpoint as potential exfiltration channel -15 ▶
The public capture endpoint accepts arbitrary event data with arbitrary properties. In a multi-skill scenario, a malicious companion skill could instruct the agent to use the PostHog capture command to send sensitive local data disguised as analytics events to the user's PostHog instance, effectively using it as a data staging ground.
INFO Shell script uses curl with -sf flags -10 ▶
The posthog.sh script uses curl with -s (silent) and -f (fail silently on HTTP errors), which means HTTP error responses are suppressed. This could mask security-relevant errors like 401 Unauthorized (leaked/invalid keys) or unexpected redirects.