visitor-identification
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the official
@cargo-ai/clipackage for managing CDK resources and fetches the Snitcher tracking script fromcdn.snitcher.com, a well-known service for this purpose.\n- [REMOTE_CODE_EXECUTION]: A client-side React component (VisitorConsent) dynamically loads the Snitcher tracker script. This is the intended functionality of the skill and is strictly controlled by a consent banner that requires explicit user approval before any external script is requested.\n- [DYNAMIC_EXECUTION]: Theevals/contract.mjsscript utilizes dynamicimport()to load infrastructure declarations for build-time validation. This process is limited to the skill's own local directory and ensures the adapters follow security best practices.\n- [DATA_EXFILTRATION]: While the skill's core purpose is to collect visitor data, it is designed to be company-level only. The logic insite/lib/snitcher.tsmanually overrides and disables intrusive features such as form tracking, session recording, and personal identification to minimize data exposure risk.
Audit Metadata