competitor-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites, creating a surface for indirect prompt injection where malicious content on a scraped page could attempt to override agent instructions.\n
- Ingestion points: The skill utilizes a
firecrawl.pyconnector script to scrape external URLs provided by the user, returning rendered page content as markdown to the LLM (SKILL.md).\n - Boundary markers: There are no documented delimiters or instructions to treat the scraped content as data rather than instructions, increasing the risk of the agent following embedded commands.\n
- Capability inventory: The skill possesses capabilities to write to local memory files (
memory/hot-cache.md,memory/open-loops.md,memory/research/) and execute local Python scripts (SKILL.md).\n - Sanitization: No explicit sanitization, filtering, or validation of the ingested markdown content is described before it is synthesized by the model.\n- [COMMAND_EXECUTION]: The skill invokes a local Python script using shell commands to perform web scraping operations.\n
- Evidence: The skill uses
python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connectors/firecrawl.py" scrape <competitor-url>to retrieve competitor data (SKILL.md).
Audit Metadata