campaign-audit
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute several local Python scripts, including performance-monitor.py and seo-executor.py, to perform the audit logic and data collection.
- [DYNAMIC_EXECUTION]: Shell commands are constructed dynamically using the ${CLAUDE_PLUGIN_ROOT} environment variable and user-supplied brand slug arguments, which is a standard pattern for skill script execution.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external marketing channels (e.g., campaign names, keywords, and ad creatives) that is incorporated into the generated audit reports.
- Ingestion points: External performance and inventory data retrieved from platforms such as Google Ads, Meta, and LinkedIn.
- Boundary markers: The skill does not explicitly define delimiters or instructions to ignore instructions embedded within the retrieved campaign content.
- Capability inventory: The agent has access to the Bash, Read, Glob, and Grep tools.
- Sanitization: No specific procedures for sanitizing or escaping the external marketing content are mentioned before it is added to the audit markdown report.
Audit Metadata