cookie-consent
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to maintain an audit trail of consent preferences.
- Ingestion points: The handler in
pages/api/consent.tsingests preferences and metadata directly from the request body (req.body). - Boundary markers: The skill does not employ specific delimiters to isolate user-provided preference data from the logging context.
- Capability inventory: The backend code performs database writes and processes network metadata such as IP addresses and User-Agents.
- Sanitization: Input data is converted to a JSON string for storage but is not validated against a rigid schema or sanitized before database insertion.
- [EXTERNAL_DOWNLOADS]: The skill fetches code from an external well-known provider.
- Evidence: The skill dynamically loads tracking scripts from
https://www.googletagmanager.com/gtag/jsupon user consent.
Audit Metadata