analytics-tracking
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides implementation guides for official analytics services including Google Analytics 4, Google Tag Manager, and Facebook Pixel. References to external scripts from these providers are standard practices for web tracking implementation.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from user requests and context files. Ingestion points: User input and .agents/product-marketing-context.md. Boundary markers: Absent. Capability inventory: Generation of tracking plans and code snippets (no direct execution capabilities). Sanitization: Absent. The lack of delimiters for untrusted data represents a standard attack surface for indirect prompt injection.
Audit Metadata