competitor-tracker
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill consists entirely of Markdown instructions and templates. No scripts, binaries, or executable code are included in the skill package itself. It relies on standard environment tools and pre-existing scripts mentioned in the instructions.
- [COMMAND_EXECUTION]: The skill provides instructions for executing specific data-collection scripts (e.g.,
gdelt.py,youtube.py,rss_monitor.py). These are standard informational tools for gathering public news and social media metrics. The commands are well-defined and do not incorporate unvalidated user input into shell execution. - [EXTERNAL_DOWNLOADS]: The instructions mention using a YouTube RSS feed for tracking posting cadence. This is a standard, well-known service used for its intended purpose (monitoring public video updates) and does not represent a security risk.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from public social media posts and news indices. However, it implements a highly structured analysis workflow using strict Markdown templates, which acts as a boundary against accidental instruction obedience from processed content. The capabilities are limited to report generation and local memory updates, minimizing the impact of potential injections.
Audit Metadata