community-and-dark-social
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Node.js script (
resources/dark-social-read.js) to process marketing data and traffic metrics. This is the primary function of the skill and uses a local script provided in the package. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface that processes user-supplied marketing metrics and attribution feedback.
- Ingestion points: Data enters the skill via a JSON configuration passed as a command-line argument to the analytical script (
resources/dark-social-read.js) as described inSKILL.md. - Boundary markers: The script utilizes
JSON.parseto enforce a strict schema, which helps validate the structure of the input data. - Capability inventory: Analysis of
resources/dark-social-read.jsshows it is limited to mathematical calculations, string comparisons, and console reporting. It lacks network access, file system write permissions, or the ability to spawn subprocesses. - Sanitization: The script implements basic sanitization through type checks (e.g.,
isNum) and string normalization (e.g.,n0) to ensure data integrity before analysis.
Audit Metadata