modeling-conversion-metrics

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted event names and properties from external analytics sources to build conversion models.
  • Ingestion points: Data enters the context via the events table in references/posthog/funnel_conversion.sql and staging references in references/dbt/stg_funnel_events.sql.
  • Boundary markers: The skill explicitly warns to treat event names as quoted data and not as instructions in SKILL.md.
  • Capability inventory: The skill's capabilities are restricted to generating and executing SQL queries for data warehouse views; no subprocess execution, network operations, or file system writes are present.
  • Sanitization: The instructions recommend verifying event names using read-data-schema and obtaining user confirmation before creating persistent views.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 06:36 PM
Security Audit — agent-trust-hub — modeling-conversion-metrics