campaign-impact-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from CRM records (HubSpot) and outreach leads (La Growth Machine) to perform attribution analysis, creating a potential vector for instructions embedded in that data.
- Ingestion points: Lead data (emails, names) fetched from La Growth Machine and deal properties (names, stages) fetched from HubSpot, as well as manual CSV/text exports provided by the user in Step 2, 3, and 4.
- Boundary markers: The instructions do not define specific delimiters (e.g., XML tags or triple quotes) or provide "ignore embedded instructions" directives to the agent for the processed data.
- Capability inventory: The skill utilizes MCP tools to fetch data, renders a UI widget via
visualize:show_widget, and can trigger new agent prompts through an interactivesendPromptbutton in the widget. - Sanitization: No explicit sanitization or filtering of the ingested strings is specified prior to matching or display in the ranked table.
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the skill via a remote repository using the
npxpackage runner. - Evidence: The README.md file contains the command
npx skills add LaGrowthMachine/gtm-system/skills/get-qualified-meetings/campaign-impact-analyzer. - Note: The target repository is maintained by the vendor (La Growth Machine) and utilizes a trusted installation utility from Vercel Labs.
Audit Metadata