competitor-teardown
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation includes an installation command that fetches and executes a shell script from inference.sh using
curl -fsSL https://cli.inference.sh | sh. This is the official installation method for the service's command-line interface. - [DYNAMIC_EXECUTION]: The skill uses the
infsh/python-executortool to execute Python code at runtime. The provided example usesmatplotlibto generate a positioning map image. The code is statically defined within the skill instructions. - [INDIRECT_PROMPT_INJECTION]: The skill defines a research framework that involves ingesting content from external competitor websites, reviews (G2, Capterra), and search results. This data ingestion surface could potentially expose the agent to malicious instructions embedded in third-party web content, though the skill focuses on structured extraction (SWOT, feature matrices).
- [EXTERNAL_DOWNLOADS]: The skill references external dependencies from the inference-sh platform, instructing the user to add them via
npx skills add inference-sh/skills@web-search.
Audit Metadata