cookie-consent

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to maintain an audit trail of consent preferences.
  • Ingestion points: The handler in pages/api/consent.ts ingests preferences and metadata directly from the request body (req.body).
  • Boundary markers: The skill does not employ specific delimiters to isolate user-provided preference data from the logging context.
  • Capability inventory: The backend code performs database writes and processes network metadata such as IP addresses and User-Agents.
  • Sanitization: Input data is converted to a JSON string for storage but is not validated against a rigid schema or sanitized before database insertion.
  • [EXTERNAL_DOWNLOADS]: The skill fetches code from an external well-known provider.
  • Evidence: The skill dynamically loads tracking scripts from https://www.googletagmanager.com/gtag/js upon user consent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 01:48 AM
Security Audit — agent-trust-hub — cookie-consent