using-gtm-skills
Fail
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides shell commands for installation (
gh skill install) and a local setup script (install.sh). These are standard procedures for initializing Agent Skills from a repository and are intended for user-driven environment setup. - [EXTERNAL_DOWNLOADS]: The
references/experts.mdfile contains numerous links to the public profiles and websites of industry experts (e.g., LinkedIn, YouTube). While automated scanners flagged two of these domains (keithrosen.comandforgetthefunnel.com), manual verification confirms they are established, legitimate professional resources for sales and marketing coaching. They are cited purely for informational purposes. - [SAFE]: The skill includes a Python script
scripts/check-output.pyused to validate that generated deliverables meet minimum length and keyword requirements. The script uses safe file reading and string operations. - [SAFE]: The skill actively promotes security best practices through dedicated playbooks like
references/gtm-security-hygiene-basics.md(covering 2FA and phishing) andreferences/gtm-data-exchange-playbook.md(covering secure data handling with customers). It also provides a Python snippet for users to verify the integrity of the skill files using SHA-256 hashes.
Recommendations
- Contains 8 malicious URL(s) - DO NOT USE
Audit Metadata