visitor-identification

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the official @cargo-ai/cli package for managing CDK resources and fetches the Snitcher tracking script from cdn.snitcher.com, a well-known service for this purpose.\n- [REMOTE_CODE_EXECUTION]: A client-side React component (VisitorConsent) dynamically loads the Snitcher tracker script. This is the intended functionality of the skill and is strictly controlled by a consent banner that requires explicit user approval before any external script is requested.\n- [DYNAMIC_EXECUTION]: The evals/contract.mjs script utilizes dynamic import() to load infrastructure declarations for build-time validation. This process is limited to the skill's own local directory and ensures the adapters follow security best practices.\n- [DATA_EXFILTRATION]: While the skill's core purpose is to collect visitor data, it is designed to be company-level only. The logic in site/lib/snitcher.ts manually overrides and disables intrusive features such as form tracking, session recording, and personal identification to minimize data exposure risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 08:46 PM