posthog/ai-plugin instrument-product-analytics
Checked the catalogued skill at instrument-product-analytics.
F; retained sample includes a high finding · SD-022 · what this rule accepts as a false positive →
F; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B set by findings not listed in the stored summary
5 suppressed by AI triage
The fetch call targets a local API endpoint, not an external host, so it is not a real threat.
The fetch call targets an internal relative endpoint '/api/auth/login', not an external host, so it does not represent an outbound network call that could exfiltrate data.
The code is part of documentation and simply demonstrates relative imports, not an executable path traversal attack.
Relative import of environment config is normal, not a malicious path traversal.
Documentation note, no evidence of malicious DNS tunneling