posthog/skills instrument-llm-analytics
Checked the catalogued skill at instrument-llm-analytics.
D; retained sample includes a high finding · SD-022 · what this rule accepts as a false positive →
A set by no findings on this axis
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
5 suppressed by AI triage
Documentation example showing a DNS lookup; no evidence of dynamic DNS tunneling or data exfiltration.
Example curl to localhost used for local proxy testing; not an outbound malicious request.
Example curl to localhost for embeddings; purely illustrative and not a real threat.
The code configures a PostHog exporter for observability, with no DNS query or dynamic hostname usage, so DNS exfiltration is unlikely.
The host URL points to a legitimate PostHog API endpoint, not a suspicious DNS tunneling pattern.