paw-mkt-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured marketing analytics guidance using professional frameworks like SOSTAC, GA4 Event Models, and UTM standards. It establishes clear delivery protocols and path resolution logic within the vendor's workspace.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of
agent-browserfrom the Vercel Labs GitHub repository. This is a trusted source used for browser automation tasks essential to the skill's auditing capabilities. - [INDIRECT_PROMPT_INJECTION]: The skill includes capabilities to audit live website URLs and ingest external data from analytics and CRM platforms. This constitutes an attack surface for indirect prompt injection. However, the risk is inherent to the skill's primary function and is mitigated by strict requirements for structured outputs and predefined measurement frameworks. Ingestion points: External website URLs audited via agent-browser, GA4/CRM data. Boundary markers: Deliverables are governed by a specific Output Contract and structured templates. Capability inventory: Shell script execution for setup, browser automation for research, and file system writes for reports. Sanitization: Not explicitly defined, but handled through structured markdown delivery.
Audit Metadata