digital-marketing-pro-claude-plugin
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites and documents, which could contain instructions designed to manipulate the agent's behavior.
- Ingestion points: The
/digital-marketing-pro:seo-auditcommand accepts target URLs, and the/digital-marketing-pro:import-guidelinescommand imports local PDF and Word documents. Additionally, the "External Research" methodology phase involves collecting data from market and competitor sources. - Boundary markers: The methodology includes a "Client Validation Document" (Part 5) where the user reviews findings before they are finalized, acting as a human-in-the-loop checkpoint.
- Capability inventory: The skill has the capability to write to a local directory (
~/.claude-marketing/), make network requests through integrated MCP servers, and execute 70 optional Python scripts if execution mode is enabled. - Sanitization: The skill documentation does not mention specific sanitization or escaping mechanisms for the external data before it is presented to the LLM.
- [EXTERNAL_DOWNLOADS]: The plugin is installed from a third-party GitHub marketplace and repository (
indranilbanerjee/neels-plugins) that is not identified as a verified vendor source. - [DYNAMIC_EXECUTION]: The skill provides an optional
DM_PRO_EXECUTION_MODEthat allows for the execution of 70 Python scripts bundled with the skill to automate research, analytics, and integration tasks.
Audit Metadata