analytics-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends using official and widely-recognized software, including the
facebook-nodejs-business-sdkfor server-side events and established WordPress plugins like MonsterInsights and PixelYourSite for WooCommerce integration. These references are consistent with standard industry practices. - [INDIRECT_PROMPT_INJECTION]: The skill includes code templates that handle untrusted data (e.g., product metadata and order identifiers).
- Ingestion points: Untrusted data enters the context via
orderandproductobjects passed to tracking functions inSKILL.mdand evaluation scripts. - Boundary markers: Not explicitly required for these data layer templates, though standard JavaScript string handling is used.
- Capability inventory: Network operations via the
facebook-nodejs-business-sdkandcurlfor validation. - Sanitization: The skill explicitly notes that PII like emails are automatically hashed by the SDK before transmission.
Audit Metadata