Sarah Sanders presents PostHog's Wizard, an agentic command-line tool that reads a codebase, installs the appropriate SDK, instruments events, and builds dashboards. Those capabilities also give the agent a malware-like risk profile because it can consume project context and run commands on a developer's machine.
The security review found that prompts alone were not controls and that individually reasonable features could combine into exploitable paths. The system therefore denies Bash by default, restricts packages and commands, blocks environment-file access, routes secrets through a vault, and scans both content entering the agent and output leaving it.
A deterministic YARA-based scanner called Warlock separates detection from enforcement and caught risky behavior including subagents trying to bypass guardrails, attempts to obtain secrets, and personally identifiable information being written into analytics events. An LLM triage layer may reduce false-positive noise only after deterministic rules have blocked dangerous input, and any triage failure closes the workflow.
The practical lesson is defense in depth: scan the context supply chain when skills are built and again when they are used, test rules against positive and negative examples, set severity by real-world impact, and keep probabilistic judgment away from the enforcement path.
Watch on YouTube
