fluentcrm-event-tracking
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents standard WordPress and FluentCRM development practices. It correctly emphasizes the use of experimental flags for guarding features and validates data types (e.g., casting to string/int) in code examples.
- [DATA_EXPOSURE_EXFILTRATION]: The skill includes a dedicated 'Privacy and safety' section that warns developers against storing access tokens, personal secrets, or raw request bodies in event logs. This promotes secure handling of sensitive data.
- [INDIRECT_PROMPT_INJECTION]: While the skill describes an API that ingests data from external sources (plugins/user activity), it explicitly notes that the
event_key,title, andvaluefields are sanitized by the core FluentCRM handlers (EventTrackingHandler). It provides a clear evidence chain of ingestion points (trackmethod), capabilities (database persistence), and mandatory sanitization, reducing the risk of injection through tracked event data.
Audit Metadata