skills/terminalskills/skills/umami/Gen Agent Trust Hub

umami

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to clone the official Umami repository from GitHub (umami-software/umami). This is a legitimate download from the official source of the software described in the skill.
  • [COMMAND_EXECUTION]: Includes standard commands for deployment via docker compose. These are intended for local environment setup as part of the primary purpose of the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill contains logic to process data from web forms (e.g., formData.get("subject")) and transmit it to an analytics endpoint.
  • Ingestion points: Ingests data through the handleSubmit function in the tracking examples.
  • Boundary markers: No explicit delimiters are used in the example code.
  • Capability inventory: The skill demonstrates how to perform network operations using the fetch API and the global umami object.
  • Sanitization: No sanitization is performed on the tracked event data in the provided examples, which is standard for client-side analytics tracking.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 07:58 PM