campaign-analytics
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill adheres to its stated purpose of campaign analysis without any evidence of malicious patterns, credential harvesting, or unauthorized network operations.
- [PROMPT_INJECTION]: Analysis of Indirect Prompt Injection (Category 8) surface: • Ingestion points: Data enters the context via CSV, Google Sheets, or CRM exports as described in Phase 2 of the SKILL.md. • Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are specified for untrusted data. • Capability inventory: The skill's automation is limited to a local Python script (scripts/check-output.py) that reads files for structure validation; it has no network or arbitrary execution capabilities. • Sanitization: No explicit data sanitization is mentioned. • Conclusion: The attack surface is consistent with the skill's utility and lacks the high-privilege capabilities required for exploitation.
- [COMMAND_EXECUTION]: The skill includes a local utility script, scripts/check-output.py, which verifies the presence of mandatory headers in the agent's output deliverable. It uses the standard library to read file contents and performs no dangerous actions.
- [SAFE]: The skill mentions resources like the 'LeadMagic Job Change Detector,' which are recognized as vendor-specific tools provided by the skill's author and pose no security risk.
Audit Metadata