analytics-attribution
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill involves ingesting and reporting on data from external sources, creating a potential surface for indirect prompt injection.
- Ingestion points: Data is ingested through Google Analytics and Google Search Console MCP integrations as defined in SKILL.md.
- Boundary markers: The instructions lack explicit delimiters or specific warnings to ignore instructions that might be embedded within analytics data (e.g., malicious page titles or search queries).
- Capability inventory: The skill enables the agent to generate weekly and monthly reports, perform funnel analysis, and calculate ROI based on external data.
- Sanitization: There are no instructions for sanitizing or validating the data fetched from external platforms before the agent processes or reports on it.
Audit Metadata