Summary
Sarah Sanders, a context engineer at PostHog, gives a candid security-focused talk about building and hardening the PostHog Wizard — an agentic CLI tool that automatically installs PostHog’s SDK, instruments events, and sets up dashboards in five to six minutes. The wizard reached 8,000 weekly users at the time of the talk, and that scale forced a serious reckoning with its threat model.
Sanders walks through the wizard’s anatomy — a custom context engine she calls “markdown in a trench coat,” an Ink-based terminal UI, model selection per task, and a tool set that includes Bash execution — noting that the combination looks nearly identical to a malware starter pack. She traces the security posture from Layer Zero (prompt suggestions, effectively no security) through an allow-list approach, before arriving at the threat that most reshaped her thinking: supply-chain prompt injection. Because the wizard’s context engine pulls from PostHog’s own open-source docs and repositories, a malicious pull request could poison the content pipeline and ship a prompt-injection payload to thousands of developer machines, signed by PostHog itself.
The solution is Warlock, a standalone prompt-injection scanner that checks content at both ends of the pipeline — when a skill bundle is built and again at the point of use inside the wizard. Sanders explains the dual-scan methodology as “catch it at the source, assume the source failed, catch it again at the point of use,” and argues that “we’re probably fine” is not an acceptable security posture at production scale.
📺 Source: AI Engineer · Published September 14, 2026
🏷️ Format: Hands On Build
