skills/reason-machines/marketing-skills/genpark-cross-channel-marketing-data-joiner/Gen Agent Trust Hub
genpark-cross-channel-marketing-data-joiner
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires downloading and installing code from a public GitHub repository (
https://github.com/alphaparkinc/genpark-cross-channel-marketing-data-joiner-skill.git). This source is not a pre-defined trusted organization or a well-known official package registry. - [COMMAND_EXECUTION]: The installation instructions involve executing shell commands to clone a repository and install a package using
pip install git+..., which executes remote code during the build and installation process. - [INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting data from external advertising and retail platforms (Google Ads, Facebook, Shopify, Square). It lacks explicit boundary markers or sanitization logic in the provided documentation for handling this untrusted external content, creating a surface where malicious data could potentially influence the agent's logic.
- Ingestion points: AdConnector, RetailConnector, and InventoryConnector fetching data from external APIs.
- Boundary markers: None specified in the instructions for delimiting external data from agent instructions.
- Capability inventory: File writing (
ReportGenerator.export_csv), network operations via API connectors, and execution of thegenpark_data_joinerPython module. - Sanitization: No evidence of data sanitization or validation before processing external API responses.
Audit Metadata