Google Tag Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:04 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent Google Tag Manager purpose, but it can make live/destructive GTM changes and contains a real local code-injection bug in version creation.

Install only if you are comfortable giving the skill GTM edit and publish authority. Use a least-privilege Google identity limited to the intended containers, avoid running create-version with untrusted name or notes values until the injection bug is fixed, review all JSON before upload, and require human confirmation before delete or publish operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gtm.sh:227

Finding

Python Code Injection Through Unsafely Interpolated Version Metadata

Content

View full analysis

Remediation

View remediation

other

Note

• Location: references/recipes.md:95

Finding

Generic Cross-Domain Tracking Recipe Contains Hard-Coded Third-Party Domains

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/gtm.sh (reported line 63)May include surrounding context.

sh

CONTAINER_PATH="accounts/$ACCOUNT/containers/$CONTAINER"

api_get() {
  curl -sf -H "$(auth_header)" "$BASE/$1"
}

api_post() {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents shell-based and network-capable operations against the GTM API but does not declare any explicit tool scope or permissions boundary. In an agent environment, this increases the chance that the skill can be invoked with broader-than-expected execution privileges, reducing reviewability and making misuse of external API access harder to control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises destructive actions like delete-tag/delete-trigger/delete-variable and high-impact actions like create-version and publish without warning that they can alter or push live GTM configuration. Because GTM changes can affect analytics, ad conversion tracking, and production site behavior, a user or agent could unintentionally cause outages, data loss, or incorrect measurement in a live environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file provides ready-to-use Google Tag Manager templates for conversion tracking, GA4 events, cross-domain tracking, and dataLayer variable extraction, but it does not include any warning or guidance about consent, lawful basis, PII handling, or privacy impact. In a skill specifically designed to help users deploy tracking, this omission can directly encourage unsafe or non-compliant analytics implementations, especially where user identifiers or cross-domain attribution are involved.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/gtm.sh (reported line 63)May include surrounding context.

sh

CONTAINER_PATH="accounts/$ACCOUNT/containers/$CONTAINER"

api_get() {
  curl -sf -H "$(auth_header)" "$BASE/$1"
}

api_post() {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script exposes state-changing GTM operations such as delete-tag, delete-trigger, delete-variable, create-version, and publish directly from command dispatch with no confirmation prompt, dry-run mode, or explicit safety flag. In an agent/tooling context, this increases the chance of accidental destructive or production-impacting changes from mistaken prompts, bad parameters, or automation errors.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.