analyze-performance
Warn
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: MEDIUMPERSISTENCEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill implements automated reporting by using the
gooseworks:automation_upserttool to create scheduled tasks. These tasks run a dynamically generated prompt on a recurring basis (e.g., every Monday) to perform the analysis without direct user interaction. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of CSV/Excel exports from platforms like Shopify, Meta, Google Ads, and CRMs.
- Ingestion points: Processes order logs, ad performance exports, and CRM lead data.
- Boundary markers: Uses specific section headers in reports and structured definitions in
definitions.mdto scope the agent's focus. - Capability inventory: Access to
file_read,file_write, and various MCP tools for platform data retrieval. - Sanitization: The instructions explicitly command the agent to strip PII (customer data) and net out test/staff orders, only keeping totals to avoid data exposure.
- [DYNAMIC_EXECUTION]: The skill dynamically assembles and writes an
agent_promptfor its automated scheduler. This prompt includes serialized logic and instructions derived from the skill's own reference files, which are copied into the workspace (reports/performance/method/) to facilitate execution in restricted environments without access to the full skills directory.
Audit Metadata