analytics-tracking
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions for implementing the Facebook Pixel, which involves referencing Meta's official script source (connect.facebook.net/en_US/fbevents.js). As Meta is a well-known and trusted service, this is a standard and safe practice for web analytics.
- [INDIRECT_PROMPT_INJECTION]: The skill uses an ingestion point to read business context from a local file (.claude/product-marketing-context.md). While this allows untrusted data to enter the agent context, the skill's lack of dangerous capabilities and its instructional nature make this pattern safe.
- Ingestion points: .claude/product-marketing-context.md (referenced in SKILL.md)
- Boundary markers: Absent
- Capability inventory: Limited to generating instructional text and implementation code snippets; no command execution or file-write capabilities identified in the skill body
- Sanitization: None mentioned
Audit Metadata