marketer-dashboard
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements secure credential management by requiring authentication tokens (USER_PAT) to be provided via environment variables, adhering to recommended security practices for secret handling.
- [SAFE]: Data operations are restricted to platform-native tools (agent_list_proposals, analytics_get, links_list, agent_start_run), ensuring all actions are mediated by the agent's permission system.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it retrieves and displays campaign names and strategy data from an external platform. While this is a common risk for data-display tools, it should be noted.
- Ingestion points: Campaign names and marketing metrics fetched via tool calls (SKILL.md).
- Boundary markers: Absent from the dashboard display template.
- Capability inventory: MCP tools for data retrieval and a server-side runner for HTML generation (SKILL.md).
- Sanitization: External strings are interpolated into the display output without explicit sanitization or escaping.
Audit Metadata