umami
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to clone the official Umami repository from GitHub (
umami-software/umami). This is a legitimate download from the official source of the software described in the skill. - [COMMAND_EXECUTION]: Includes standard commands for deployment via
docker compose. These are intended for local environment setup as part of the primary purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill contains logic to process data from web forms (e.g.,
formData.get("subject")) and transmit it to an analytics endpoint. - Ingestion points: Ingests data through the
handleSubmitfunction in the tracking examples. - Boundary markers: No explicit delimiters are used in the example code.
- Capability inventory: The skill demonstrates how to perform network operations using the
fetchAPI and the globalumamiobject. - Sanitization: No sanitization is performed on the tracked event data in the provided examples, which is standard for client-side analytics tracking.
Audit Metadata