PostHog

Interact with PostHog analytics via its REST API. Capture events, evaluate feature flags, query data with HogQL, manage persons, insights, dashboards, experi...

This skill is a straightforward PostHog API helper and appears coherent. Before installing: 1) Only provide PostHog credentials you trust this skill with — the POSTHOG_API_KEY (personal key) allows broad read/write access to project data; prefer scoped or read-only tokens if possible. 2) The included script calls curl and uses jq in some flows; the bundle's metadata does not declare required binaries, so ensure curl/jq/bash are available. 3) Be cautious when running or allowing automated HogQL queries — they can export sensitive data from your PostHog project. 4) Review and rotate any API keys you provide if you stop using the skill. 5) Because there is no install process, the script only runs when invoked, and the skill does not auto-install itself or request extra privileges.

Type: OpenClaw Skill Name: posthog Version: 1.0.0 The skill bundle is classified as suspicious due to a shell injection vulnerability in the `scripts/posthog.sh` helper script. Several commands within the script (e.g., `capture`, `evaluate-flags`, `create-annotation`) directly interpolate user-supplied arguments into `curl -d` string arguments without proper shell escaping. This allows an attacker to execute arbitrary commands on the system by providing specially crafted input containing command substitutions (e.g., `$(evil_command)`). While this is a significant security flaw, there is no evidence of intentional malicious behavior like data exfiltration to unauthorized destinations or persistence mechanisms; the script's core purpose is legitimate interaction with the PostHog API.