campaign-analytics

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: No evidence of malicious prompt instructions or jailbreak attempts. Instructional language is limited to usage documentation and input validation warnings.
  • [DATA_EXFILTRATION]: All scripts operate strictly on local data provided via CLI arguments. There are no network-capable modules (like requests or urllib) imported, and no hardcoded credentials or sensitive file paths were detected.
  • [REMOTE_CODE_EXECUTION]: The skill does not download or execute external code. All logic is contained within the three provided Python scripts (attribution_analyzer.py, funnel_analyzer.py, and campaign_roi_calculator.py).
  • [COMMAND_EXECUTION]: The scripts do not use os.system, subprocess, or other shell-interactive calls. They process data internally and output results to the terminal.
  • [UNVERIFIABLE_DEPENDENCIES]: The skill uses only the Python standard library (argparse, json, sys, datetime, math). There are no third-party package requirements.
  • [INDIRECT_PROMPT_INJECTION]: While the scripts ingest user-supplied JSON data, they do not interpret that data as instructions or pass it into an LLM context. The ingestion is handled securely via json.load for mathematical processing only.
  • [OBFUSCATION]: No obfuscated code, Base64-encoded strings, or hidden Unicode characters were found in the scripts or the documentation.
  • [DYNAMIC_CONTEXT_INJECTION]: No use of the !command syntax was found in the SKILL.md file.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 02:27 PM