google-analytics
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from the Google Analytics Data API to generate weekly reports as described in
references/weekly-report.md. This presents an indirect prompt injection surface where data from an external source is ingested and used to generate natural language summaries. - Ingestion points: Data is fetched using the
BetaAnalyticsDataClient.runReportmethod inlib/ga4-weekly.ts. - Boundary markers: The report template in
references/weekly-report.mdlacks explicit boundary markers or instructions for the agent to ignore embedded commands in the data. - Capability inventory: The skill uses network requests (
fetch) to communicate with Google's Measurement Protocol and utilizes official analytics libraries. - Sanitization: The implementation does not show specific sanitization of the values returned from the Data API before they are placed into the report template.
- [EXTERNAL_DOWNLOADS]: The skill integrates the official Google tag via
https://www.googletagmanager.com/gtag/js, which is a well-known and trusted service for analytics. It also utilizes standard, official Node.js packages for Google Analytics and Next.js integration.
Audit Metadata