gtm-metrics
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a well-structured set of instructions and templates for SaaS analytics. All external references target well-known industry services (e.g., ChartMogul, Meritech, HubSpot) and the author's own repositories, which represent standard vendor functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data (CRM exports, financial records, and billing data), which creates a standard attack surface for indirect prompt injection.
- Ingestion points: The skill gathers CRM exports (opportunities), financial data (S&M spend), and billing data (MRR) provided by the user (SKILL.md, Phase 1).
- Boundary markers: The instructions mandate data normalization, mapping historical stages to a standard framework, and flagging anomalies like stalled durations or zero-value opportunities (SKILL.md, Phase 2).
- Capability inventory: Includes a Python script (
scripts/check-output.py) capable of reading local file content to validate the structure of the agent's deliverables. - Sanitization: Employs multi-system reconciliation (e.g., requiring CRM and billing revenue to match within 2%) and period alignment rules to ensure data integrity.
Audit Metadata