adattributionkit
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references documentation and media resources hosted on
sosumi.ai, which is an external domain used for technical demonstrations and mock documentation. - [INDIRECT_PROMPT_INJECTION]: The skill defines a process for ingesting external data from ad networks in the form of JWS strings.
- Ingestion points: Ad impressions are ingested using the
AppImpressionAPI inSKILL.mdandreferences/adattributionkit-patterns.md. - Boundary markers: The skill focuses on code integration rather than prompt boundaries for this data.
- Capability inventory: The integrated code has the capability to modify app state via
Postback.updateConversionValueand configure HTTPS endpoints for attribution reporting. - Sanitization: The skill explicitly provides and recommends the use of cryptographic signature verification (JWS/ES256) to ensure the integrity and authenticity of the external data before it is processed.
Audit Metadata