analytics-tracking
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill instructions follow industry best practices for analytics implementation, such as avoiding the collection of PII and using consistent naming conventions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data from files like
.agents/product-marketing-context.mdto customize tracking plans. While this represents a surface for indirect prompt injection, the risk is negligible as the agent's output is limited to text-based documentation and code templates that require manual implementation. - Ingestion points: Local context files (
.agents/product-marketing-context.md) and user-provided descriptions of site features. - Boundary markers: None present in the prompt instructions to isolate external context.
- Capability inventory: Generates tracking plans and implementation code (gtag.js, GTM dataLayer); no tool-based file writing or network execution capabilities are defined.
- Sanitization: No explicit content sanitization is implemented in the skill instructions.
Audit Metadata