tracking-health
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [SAFE]: Analysis of SKILL.md and all files in the references/ directory confirms that the skill is purely informational and instructional. It does not contain code intended for execution by the agent beyond standard natural language processing of instructions.
- [DATA_EXFILTRATION]: The skill acts as a security manual for tracking. In references/url-pii-protection.md, it details how to prevent PII from being exfiltrated via GA4 payloads. It recommends architecture-level fixes and GTM-level overrides to sanitize URLs before data collection.
- [INDIRECT_PROMPT_INJECTION]: In references/geo/tw.md, the skill addresses the ingestion of untrusted data from the LINE Messaging API. It identifies the risk of forged events and mandates signature verification using HMAC-SHA256 to validate incoming data.
- [CREDENTIALS_UNSAFE]: In references/ga4-implementation.md, the skill provides examples using placeholders for sensitive values and provides explicit warnings against hardcoding real secrets in the codebase or frontend environments.
Audit Metadata