attribution
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides informational content and implementation templates for marketing attribution models. A thorough review of all documentation and code snippets revealed no malicious patterns or security risks.
- [DATA_EXFILTRATION]: The skill provides guidance and code for sending event data to external analytics platforms (such as PostHog). These network operations are standard for the skill's primary function of marketing tracking. The provided implementation patterns include explicit security features, such as an "Anonymity guard," to prevent the leakage of PII into third-party URLs and webhooks.
- [INDIRECT_PROMPT_INJECTION]: The skill describes processing "Self-reported attribution" data, which constitutes untrusted input from end-users (e.g., survey responses). The documentation manages this attack surface by instructing the agent to treat this data as a triangulation input rather than authoritative truth and outlines specific guardrails for data validation and identity merging.
Audit Metadata