express-gtm-audit
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns such as credential exfiltration, remote code execution, or obfuscation were detected. All external URLs and resources belong to the author or well-known services.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted data from the web (e.g., website content, LinkedIn posts). This is a standard risk for data-gathering skills where malicious content on a target site could attempt to influence the agent's output. This is a characteristic of the skill's intended purpose and not a sign of malicious intent.
- Ingestion points: Data is gathered from external company websites, social media platforms, and search engine results.
- Boundary markers: The skill organizes data into predefined table structures and scores, though it lacks explicit delimiters to isolate external text.
- Capability inventory: The skill focus is on data collection and static report generation; it does not contain capabilities for arbitrary command execution or system modifications.
- Sanitization: The instructions do not specify any sanitization routines for the data fetched from external sources.
Audit Metadata