attribution
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructional content and code patterns for marketing attribution. Analysis of all six files, including detailed JavaScript implementation guides in
references/first-party-tracking.md, shows adherence to security best practices. Specifically: - [DATA_EXPOSURE_AND_EXFILTRATION]: No evidence of hardcoded credentials or unauthorized data access. Code snippets for webhooks use variables/placeholders for API keys and endpoints. The use of
fetch()is explicitly for sending event data to defined analytics providers (e.g., PostHog) in line with the skill's purpose. - [OBFUSCATION]: No obfuscated content, encoded strings, or hidden characters were found in the instructions or code examples.
- [PROMPT_INJECTION]: Instructions focus on marketing strategies and technical implementation without attempting to override agent behavior or safety filters.
- [INDIRECT_PROMPT_INJECTION]: While the skill describes systems that ingest external data (webhooks), the implementation guide includes specific hardening recommendations such as identity validation and anonymity guards (
isAnonymousDistinctId) to prevent data corruption or PII leakage. - [UNVERIFIABLE_DEPENDENCIES]: The skill references well-known marketing and analytics services (PostHog, Segment, HubSpot, etc.) but does not include any automated or suspicious package installations.
Audit Metadata