using-gtm-skills

Fail

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides shell commands for installation (gh skill install) and a local setup script (install.sh). These are standard procedures for initializing Agent Skills from a repository and are intended for user-driven environment setup.
  • [EXTERNAL_DOWNLOADS]: The references/experts.md file contains numerous links to the public profiles and websites of industry experts (e.g., LinkedIn, YouTube). While automated scanners flagged two of these domains (keithrosen.com and forgetthefunnel.com), manual verification confirms they are established, legitimate professional resources for sales and marketing coaching. They are cited purely for informational purposes.
  • [SAFE]: The skill includes a Python script scripts/check-output.py used to validate that generated deliverables meet minimum length and keyword requirements. The script uses safe file reading and string operations.
  • [SAFE]: The skill actively promotes security best practices through dedicated playbooks like references/gtm-security-hygiene-basics.md (covering 2FA and phishing) and references/gtm-data-exchange-playbook.md (covering secure data handling with customers). It also provides a Python snippet for users to verify the integrity of the skill files using SHA-256 hashes.
Recommendations
  • Contains 8 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Oct 10, 2026, 12:53 PM