zero-cost-tracking
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to capture and transmit user-supplied information, such as email addresses and phone numbers, to external platforms including Google Tag Manager and Meta (via Cloudflare Zaraz) for conversion tracking purposes. This behavior is transparently documented as the primary function of the skill.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@leadgen/conversion-trackingpackage from the npm registry to provide its core tracking and attribution functionality. - [INDIRECT_PROMPT_INJECTION]: The skill establishes a data processing surface by ingesting user-supplied form data for tracking events.
- Ingestion points: User input is collected via
formDatain thehandleSubmitfunction withinSKILL.md. - Boundary markers: The implementation does not utilize specific delimiters or instructions to the agent to ignore potentially malicious instructions embedded in the user data.
- Capability inventory: The skill performs network operations using
fetchto a local/api/leadendpoint and interacts with the browser'sdataLayerandzarazobjects. - Sanitization: The example code snippets demonstrate data extraction but do not explicitly show input sanitization or validation beyond standard HTML form validity checks.
Audit Metadata