retargeting-strategy
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
campaign-tracker.pyto audit existing campaign performance. This command uses a brand identifier retrieved from local configuration files. - [PROMPT_INJECTION]: The skill ingests untrusted data from local configuration files which is then used as a parameter for script execution, creating an indirect injection surface.
- Ingestion points: Data is read from
~/.claude-marketing/brands/_active-brand.jsonandprofile.jsonwithin the SKILL.md process. - Boundary markers: None present to separate brand data from the execution context.
- Capability inventory: The skill has the capability to execute shell commands via the Python interpreter.
- Sanitization: No sanitization or validation of the input data is described before it is used in the command line call.
Audit Metadata