analytics
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official implementation scripts and documentation for trusted analytics services, such as Google Analytics 4 (support.google.com) and Facebook Pixel (connect.facebook.net). These references are standard for analytics implementation and target verified, well-known service domains.- [PROMPT_INJECTION]: The skill reads local context from files such as .agents/product-marketing.md and product-marketing-context.md to inform its advice. This ingestion of external data represents an indirect prompt injection surface.
- Ingestion points: The agent is instructed to read local context files from the .agents/ or .claude/ directories.
- Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present in the guidelines for reading context files.
- Capability inventory: The skill facilitates the generation of tracking plans and code snippets; it does not define capabilities for subprocess execution, file system modification, or network requests.
- Sanitization: There is no evidence of sanitization or filtering applied to the content of the ingested context files.
Audit Metadata