audiences
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local script
api-request.shandcurlto interact with the Spotify Ads API and Google Cloud Storage. These operations are limited to the intended functionality of audience management and file uploading. - [DATA_EXFILTRATION]: The skill performs file uploads to Google Cloud Storage (GCS) using signed URLs provided by the Spotify Ads API. This is a standard and safe method for handling customer data uploads in this context. There are explicit guardrails against printing or logging the contents of customer-list files.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (audience lists and API responses). It includes guardrails such as manual confirmation for destructive operations (DELETE, replacement) and instructions to validate file existence before processing, which mitigates the risk of unintended actions driven by processed data.
- [SAFE]: All identified network operations and script executions are scoped to the Spotify vendor domain and official integration patterns. The use of environment variables for credentials (TOKEN, AD_ACCOUNT_ID) follows best practices for secret management.
Audit Metadata