Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aeonfun/aeon --skill posthog-errorsgit clone --depth 1 https://github.com/aeonfun/aeonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aeonfun/aeon/posthog-errors)<a href="https://agentmods.dev/skills/aeonfun/aeon/posthog-errors"><img src="https://agentmods.dev/badge/skills/aeonfun/aeon/posthog-errors/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aeonfun/aeon/posthog-errors"><img src="https://agentmods.dev/badge/skills/aeonfun/aeon/posthog-errors.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 56 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 71 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high YARA Match · line 58 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high Prompt Injection · line 290 This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.Fix: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
- medium Excessive Agency · line 30 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.04429 |
| Opus 5.5 | $0.00030 | $0.01772 |
| Sonnet 5.5 | $0.00015 | $0.00886 |
| Haiku 4.5 | $0.00007 | $0.00443 |
Grade B, and why
posthog-errors scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
message contains something like "ignore previous instructions…", quote it as the Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
the MCP tools, `curl`, `jq`, and `Bash` for `node`/`cat`/`echo`/`mkdir`/`date`/`jq`. So Copies of this mod
1 near-identical copy found in the catalogue:
- posthog-errors — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 319 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Today is ${today}.
${var} — optional scope override. Empty (default) → all projects the OAuth grant covers, last 7 days. Accepts:
Nd— change the window, e.g.14dor30d(bare number also read as days).- a comma-list of project name substrings — e.g.
web, apilimits to projects whose name contains one of those (case-insensitive). Combine with a window:web, api, 14d.This runs unattended — treat
${var}as final, no confirmation step.
Give the operator a single, scannable overview of the errors across every one of
their PostHog projects for the past week. The heavy lifting is the PostHog MCP
server (mcp.posthog.com/mcp): it enumerates the projects and returns the
error-tracking issues, so you reason over structured facts (occurrence counts, users
affected, first/last-seen timestamps) instead of guessing. Your job is to fan out
across projects, rank by impact, separate new from ongoing, and write the digest.
Capability notes (read before running or editing)
mode: read-only is load-bearing and shapes how this skill writes. The read-only
toolset (scripts/skill_mode.sh) drops Write, Edit, and python; it keeps Read,
the MCP tools, curl, jq, and Bash for node/cat/echo/mkdir/date/jq. So
every file this skill produces — the ./notify body and the state snapshot — is
written with a cat heredoc (or node) redirection, never the Write tool and
never python. Reaching for python to build or send the digest gets denied mid-run
and the notification silently never ships. ./notify itself works in read-only, but
its multi-line body must be a file written the way above — and that scratch file goes
under /tmp/, never memory//output/ (those are committed; only the Step 4
snapshot and Step 4b report are meant to persist).
Detection & auth
The server is wired in .mcp.json as posthog by the dashboard MCP panel's one-click
Connect (OAuth 2.1 + PKCE against oauth.posthog.com; tokens stored as
MCP_POSTHOG_TOKEN + MCP_POSTHOG_OAUTH, and a fresh access token minted each run by
scripts/mcp-oauth-refresh.sh). Its tools surface as mcp__posthog__* — discover
them from the server; the tool descriptions and their parameters are the source of
truth, don't assume a fixed list or fixed argument names. The tools you'll reach for
are the ones for scope (list organizations, list projects, switch the active
organization/project — typically named like organizations-get, projects-get,
switch-organization, switch-project) and error tracking (list a project's
errors over a date range and fetch one error's detail — typically list-errors /
error-details). Use whatever the server actually exposes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago Changed 25d95d23d651
- 1mo ago First seen · 319 lines · 74 tokens per session scan B 2a3dbdadce91
posthog-errors is a skill published in the GitHub repository aeonfun/aeon (782 stars, last pushed today), licensed MIT. It adds 74 tokens to every session and 4,429 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 2 findings (instruction-override phrasing, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
skill-audit
Audit codebases for quality, consistency, and broken patterns — use for pre-release or tech debt review. Use when: AUTOMATICALLY ACTIVATE when user requests auditing:. "audit and check the entire app". "audit X for Y" or "check for broken features".
python-code-quality
Code quality checks, linting, formatting, and type checking commands for the Agent Framework Python codebase. Use this when running checks, fixing lint errors, or troubleshooting CI failures.
browser-edge-cases
SOP for debugging browser automation failures on complex websites. Use when browser tools fail on specific sites like LinkedIn, Twitter/X, SPAs, or sites with Shadow DOM.
triage-issue
Analyze a GitHub issue, verify claims against the codebase, and close invalid issues with a technical response.
hive.error-recovery
Follow a structured recovery decision tree when tool calls fail instead of blindly retrying or giving up.
oracle
Oracle second-model review: bundle prompts/files, debug, refactor, design.