pdf-report
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE]: The skill reads from the
~/.claude-marketing/directory to access brand profiles (profile.json), active brand configurations (_active-brand.json), and visual guidelines (_manifest.json). While these are application-specific paths, they involve access to the user's home directory. - [COMMAND_EXECUTION]: The skill relies on executing local Python scripts (
pdf-generator.py,campaign-tracker.py,performance-monitor.py,competitor-tracker.py) to retrieve performance data and generate the final document payload. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests data from external analytics MCPs (Google Analytics, Google Ads, Meta) and brand configuration files.
- Boundary markers: There are no specified delimiters or instructions provided to the agent to disregard potential instructions embedded within the ingested campaign or performance data.
- Capability inventory: The skill has the capability to execute shell-based Python scripts and write structured report files to the system.
- Sanitization: No validation or sanitization logic is described for the data retrieved from external sources before it is passed to the generation script.
Audit Metadata