campaign-analytics
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were detected. The skill's behavior is consistent with its stated purpose of marketing analytics and uses standard data processing patterns.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted campaign data (CSV/CRM exports) and email copy variants, which constitutes an attack surface for indirect prompt injection. However, the risk is mitigated as the skill's logic is confined to analytical reporting without executing high-risk operations based on the ingested data.\n
- Ingestion points: External campaign data and email copy are ingested in Phase 2 (Data Assembly) and Phase 3 (Messaging & Copy) of the process.\n
- Boundary markers: No explicit delimiters or instructions to ignore embedded content are specified for the data ingestion phase.\n
- Capability inventory: The skill performs statistical analysis and report generation; it does not contain automated subprocess calls or network operations triggered by the ingested content.\n
- Sanitization: The skill maps input data to a canonical schema during assembly, providing a basic layer of structure validation.\n- [COMMAND_EXECUTION]: The skill includes a Python script (
scripts/check-output.py) designed to validate the structure of the generated report.\n - Evidence: The script reads a file path from command-line arguments and checks for the presence of specific markdown headers. It does not execute arbitrary code or expose the contents of the files it reads.
Audit Metadata