attribution-model
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs legitimate analytical tasks for marketing attribution modeling. It processes user-provided inputs and local configuration data to produce structured reports. No evidence of malicious intent or dangerous capabilities was found.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external local sources including brand profiles (
profile.json), brand guidelines (_manifest.json), and industry context (compliance-rules.md). While this constitutes an attack surface for indirect prompt injection if these files are compromised, the skill's impact is minimal as it only generates text-based recommendations and does not possess capabilities for file modification, network operations, or shell execution. - [DATA_EXPOSURE]: The skill reads from the
~/.claude-marketing/directory. This is consistent with the skill's stated purpose of managing brand-specific marketing context and does not target sensitive system paths like SSH keys or cloud credentials.
Audit Metadata