adattributionkit

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references documentation and media resources hosted on sosumi.ai, which is an external domain used for technical demonstrations and mock documentation.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a process for ingesting external data from ad networks in the form of JWS strings.
  • Ingestion points: Ad impressions are ingested using the AppImpression API in SKILL.md and references/adattributionkit-patterns.md.
  • Boundary markers: The skill focuses on code integration rather than prompt boundaries for this data.
  • Capability inventory: The integrated code has the capability to modify app state via Postback.updateConversionValue and configure HTTPS endpoints for attribution reporting.
  • Sanitization: The skill explicitly provides and recommends the use of cryptographic signature verification (JWS/ES256) to ensure the integrity and authenticity of the external data before it is processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 11:13 AM
Security Audit — agent-trust-hub — adattributionkit