posthog/skills instrument-product-analytics
Checked the catalogued skill at instrument-product-analytics.
F; retained sample includes a critical finding · SD-013 · what this rule accepts as a false positive →
F; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B set by findings not listed in the stored summary
55 suppressed by AI triage
The context shows no actual Base64 payload, just blank lines, indicating a false positive.
No Base64 content present in the surrounding context, so the detection is likely a false positive.
No actual path traversal or absolute paths present in the file.
No actual path traversal or absolute paths present in the file.
No actual path traversal or absolute paths present in the file.
No actual path traversal or absolute paths present in the file.
No actual path traversal or absolute paths present in the file.
No actual path traversal or absolute paths present in the file.
The file is documentation; the flagged pattern appears only in example text, not executable code.
The file is documentation; the flagged pattern is part of a textual example, not real code.
The flagged outbound network call appears in a documentation snippet, not in executable code.
The file is documentation and only references a path traversal pattern, not executable code.
Only a textual reference in documentation, no executable code or configuration enabling outbound network calls.
Mentions of path traversal patterns are in documentation examples, not executable code.
Path traversal references are in documentation examples, not executable code.
Outbound network call patterns are described in documentation, not active code.
Outbound network call references are in documentation examples, not executable code.
The file is documentation; the matched text is a placeholder, not an actual persistence mechanism.
The file is documentation; the matched text is a placeholder, not an actual persistence mechanism.
Documentation shows a client-side fetch to an internal API endpoint, not an external host.
Documentation shows a client-side fetch to an internal API endpoint, not an external host.
Documentation shows a client-side fetch to an internal API endpoint, not an external host.
The documentation file does not contain executable persistence code; the detection string is probably a placeholder, not a real threat.
Similarly, this line is part of a documentation example, not an actual persistence setup.
The referenced section contains only empty lines, not any ../ or absolute path usage.
The file is documentation containing example code, not an active outbound network call or permission grant.
The code initializes a PostHog analytics client to a known public endpoint, which is a benign outbound network call.
The file is documentation and only contains a placeholder text, not an actual outbound network call or permission grant.
Same as above; the line is a documentation note, not executable code or config.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
Documentation file contains no executable or configuration code indicating DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The flagged line contains only empty lines and no traversal or absolute path patterns.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is documentation text, not executable code or configuration that would perform outbound network calls.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The matched phrase does not appear in the file; the context shows only empty lines, indicating a false positive.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The matched phrase does not appear in the file; the context shows only empty lines, indicating a false positive.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The matched phrase does not appear in the file; the context shows only empty lines, indicating a false positive.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.
The content is a documentation note, not executable code or configuration that could perform DNS exfiltration.