soborbo-tracking
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits user-submitted PII, such as emails and phone numbers, to external endpoints including Meta's Conversions API and a configurable Google Sheets webhook. This functionality is the primary purpose of the tracking skill. PII is hashed using SHA-256 before transmission to the Meta API.
- [EXTERNAL_DOWNLOADS]: Integrates with external tracking services by loading scripts from well-known providers like Google Tag Manager and CookieYes.
- [SAFE]: The tracking API endpoint (/api/track) implements multiple defensive layers, including payload size restrictions, strict Zod schema validation, origin allowlisting, and optional HMAC token-based authentication.
- [SAFE]: Tracking activities and data persistence are conditionally executed based on user consent status, checked via a dedicated management layer in consent.ts.
Audit Metadata