budget-tracker

Pass

Audited by Gen Agent Trust Hub on Apr 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes bundled Python scripts including scripts/ad-budget-pacer.py, scripts/budget-optimizer.py, and scripts/performance-monitor.py to calculate budget pacing, generate optimization recommendations, and persist historical snapshots. These operations are core to the skill's intended analytical functionality.
  • [EXTERNAL_DOWNLOADS]: Fetches real-time marketing spend and efficiency metrics from well-known advertising services such as Google Ads, Meta Marketing, LinkedIn Marketing, and TikTok Ads. These network operations are necessary for tracking actual expenditure against defined targets.
  • [DATA_EXFILTRATION]: Reads brand-specific configuration files, budget targets, and marketing SOPs from the local ~/.claude-marketing/ directory. This data access is used to contextualize the analysis within the user's specific business environment.
  • [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by ingesting data from external advertising platforms and local configuration files.
  • Ingestion points: External ad platform APIs (Google, Meta, LinkedIn, TikTok) and local brand JSON profiles.
  • Boundary markers: None specified in the instructions to delimit external data from agent instructions.
  • Capability inventory: Execution of local Python scripts for data modeling, optimization, and snapshot persistence.
  • Sanitization: No explicit sanitization or validation of the external platform data is described prior to processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 1, 2026, 01:18 AM