context-engine

Pass

Audited by Gen Agent Trust Hub on May 29, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a comprehensive framework for managing marketing context, industry benchmarks, and campaign execution using a 12-part methodology.
  • [SAFE]: Implements a strict 'Credential Isolation' model (documented in agency-operations-guide.md and crm-integration-guide.md). Secrets are stored in ~/.claude-marketing/credentials/ with restricted OS-level permissions (chmod 600) and the system enforces hard boundaries between brand accounts.
  • [SAFE]: Features an 'Approval Framework' (approval-framework.md) that classifies marketing actions by risk level. High-risk actions (e.g., ad budget changes, bulk email sends, CRM data deletion) require explicit user confirmation or multi-step compliance reviews.
  • [SAFE]: Includes a 'Content QA System' (eval-framework-guide.md) that orchestrates specialized Python scripts to score content for brand voice, readability, hallucination risk, and factual verifiability. This serves as a significant mitigation against AI-generated errors and indirect prompt injection.
  • [SAFE]: All external service integrations (Google Analytics, HubSpot, Salesforce, DeepL, etc.) reference well-known technology providers and follow standard OAuth or API key practices.
  • [SAFE]: References to external package installation (e.g., npx -y @anthropic-ai/mcp) occur within developer-focused documentation intended to guide user setup of their own Model Context Protocol (MCP) servers, rather than arbitrary runtime execution of untrusted code.
Audit Metadata
Risk Level
SAFE
Analyzed
May 29, 2026, 05:42 AM
Security Audit — agent-trust-hub — context-engine