attribution
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily instructional and provides high-quality guidance for marketing attribution. It includes production-ready patterns for tracking that prioritize user privacy and data integrity.
- [EXTERNAL_DOWNLOADS]: The skill references and provides integration patterns for well-known services such as PostHog, HubSpot, Google Analytics 4, Salesforce, and SavvyCal. These references are documented neutrally as part of the skill's primary function to facilitate cross-platform marketing data analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a framework for ingesting data from marketing platforms and third-party webhook payloads.
- Ingestion points: Data retrieved from marketing tools (e.g., Google, Meta) and CRM systems (HubSpot, Salesforce) via standard MCP integrations, as well as webhook payloads from booking tools (SavvyCal, Calendly) as described in
references/first-party-tracking.md. - Boundary markers: The instructions include a dedicated "Guardrails" section that prescribes "Anonymity guards" to prevent the smuggling of PII and ensure that identity merging only occurs on anonymous identifiers.
- Capability inventory: The skill interacts with external marketing and analytics APIs via MCP tools and provides code templates for server-side event processing.
- Sanitization: The skill recommends rigorous data normalization (e.g., email trimming and casing) and input validation (e.g., length and format checks for IDs) in the
references/first-party-tracking.mdimplementation guide to maintain data hygiene.
Audit Metadata