agency-dashboard
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts such as campaign-tracker.py, execution-tracker.py, and team-manager.py to collect operational data. These tools are used for their intended purpose of data aggregation for the dashboard.
- [PROMPT_INJECTION]: An indirect prompt injection surface is present because the skill processes untrusted data from client profiles and execution logs. 1. Ingestion points: Data is read from ~/.claude-marketing/ directories and script outputs. 2. Boundary markers: The skill instructions do not specify any delimiters to isolate ingested content. 3. Capability inventory: The skill can execute local scripts. 4. Sanitization: No explicit sanitization of input data is defined in the process.
Audit Metadata