pdf-report
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates report generation by executing local Python scripts:
campaign-tracker.py,performance-monitor.py,competitor-tracker.py, andpdf-generator.py. These scripts appear to be standard components of the application environment used for data retrieval and document rendering. - [DATA_EXPOSURE]: The skill accesses local configuration files within the
~/.claude-marketing/directory to retrieve brand profiles and guidelines. This file access is scoped to the application's own data directory. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources including Google Analytics, Google Ads, and Meta. This represents a potential attack surface if malicious instructions are embedded in campaign names or metadata from these platforms. However, the skill primarily uses this data for metric analysis and structured report generation, which limits the impact of such injections.
Audit Metadata