offsite-signal-analyzer
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No attempts to override agent instructions or bypass safety guidelines were found in the skill content.\n- [COMMAND_EXECUTION]: The skill uses local Python scripts for specialized data processing and logging.\n
- Scripts used: gdelt.py, ledger.py, and tavily.py, all located in the internal plugin directory (${CLAUDE_PLUGIN_ROOT}).\n
- The instructions provide the agent with the necessary command patterns to invoke these tools securely for marketing analysis.\n- [INDIRECT_PROMPT_INJECTION]: The skill identifies a clear ingestion surface for external data but provides appropriate mitigations.\n
- Ingestion points: GA4/GSC exports, server access logs, and backlink CSVs are identified in SKILL.md as primary inputs.\n
- Boundary markers: Data is processed in separate modes (backlinks and ai-referrals) with specific reporting requirements.\n
- Capability inventory: The skill utilizes internal Python scripts and the WebFetch tool for data operations.\n
- Sanitization: Includes a security instruction to treat all fetched or pasted content as untrusted and to ignore any instructions found within that data.\n- [DATA_EXPOSURE]: No hardcoded credentials, API keys, or access to sensitive system files (such as SSH keys or cloud provider configs) were detected.\n- [REMOTE_CODE_EXECUTION]: No patterns of downloading or executing scripts from remote or untrusted sources were identified.
Audit Metadata