bootstrap-google-analytics
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill automates the configuration of Google Analytics in a Phoenix application, which is a common and legitimate development task. It follows framework-specific best practices for configuration management.
- [EXTERNAL_DOWNLOADS]: The skill adds code to the target application that fetches the Google Analytics library from
www.googletagmanager.com. This is the standard and expected behavior for the stated purpose of the skill. The target domains are well-known and reputable services. - [CREDENTIALS_SAFE]: The skill correctly instructs the user to manage the Google Analytics Measurement ID through environment variables in
runtime.exsand provides a placeholder in.env.samplerather than hardcoding credentials. - [INDIRECT_PROMPT_INJECTION]: The skill reads existing application files (
mix.exs,root.html.heex, and config files) to detect the current setup. While this constitutes an ingestion surface for untrusted data, the skill has no dangerous capabilities (like network exfiltration of file contents or arbitrary command execution) that could be exploited via this channel. It uses specific pattern matching for discovery rather than broad execution.
Audit Metadata