bmad-agent-marketing-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of the
agent-browserutility from Vercel Labs' official GitHub repository. This is a trusted resource used to enable automated website audits for tracking verification. - [COMMAND_EXECUTION]: It includes instructions for installing necessary CLI tools via
npmandnpx, and executing shell-based research commands. These actions are standard for setting up the required environment to perform analytics audits. - [DYNAMIC_EXECUTION]: The skill uses JavaScript evaluation through
agent-browser evalto inspect the runtime environment of a target website. This is used specifically to verify the presence and configuration of marketing tags like Google Analytics 4 and the Meta Pixel. - [INDIRECT_PROMPT_INJECTION]: The skill has the capability to ingest data from external websites and local configuration files, which presents a surface for indirect prompt injection.
- Ingestion points: Output from
agent-browserand local project configuration files (_bmad/config.yaml). - Boundary markers: The skill does not define specific delimiters for data retrieved from web audits.
- Capability inventory: The agent can execute shell commands, read/write files in the brand workspace, and interact with web browsers.
- Sanitization: No specific filtering or validation logic is applied to the content scraped from external URLs.
Audit Metadata