server-side-conversion-tracking
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a
docker-compose.ymlconfiguration file from the author's repository on GitHub (github.com/autonnel/autonnel) to initialize the tracking infrastructure. - [COMMAND_EXECUTION]: The instructions include running
docker compose upto start the downloaded service containers. - [DATA_EXFILTRATION]: As part of its intended purpose, the skill transmits conversion events and customer identifiers to external ad platforms (Facebook, TikTok, Google, and Bing) using their respective APIs.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from URL parameters (such as
fbclidorgclid) and visitor metadata. - Ingestion points: URL query parameters and forwarded HTTP headers.
- Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Network operations to ad platform APIs.
- Sanitization: Employs SHA-256 hashing for PII (email, phone) as required by the ad platforms.
Audit Metadata