player-analytics
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were detected. The skill operates entirely on local source code for the purpose of auditing analytics implementations.
- [DATA_EXPOSURE]: The skill instructions include a 'Self-Evolution Telemetry' phase that writes execution metadata to
~/.claude/projects/skill-telemetry.md. This is a local file write for performance tracking and persistence within the Claude Code environment and does not involve external data exfiltration. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes the entire project codebase as untrusted data.
- Ingestion points: Dependency manifests and all source code files containing analytics keywords (Step 1.1, 1.2).
- Boundary markers: None implemented to separate code content from instructions.
- Capability inventory: File system read/write access (limited to telemetry file).
- Sanitization: No sanitization of ingested code content is performed before processing.
Audit Metadata