competitive-teardown
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to gather and analyze data from external, untrusted sources which can contain malicious instructions.
- Ingestion points: Data collection occurs from external websites, App Store reviews, job postings, and social media as described in
SKILL.mdandreferences/data-collection-guide.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' markers when handling content fetched from these external sources.
- Capability inventory: The skill workflow utilizes network access for data gathering (e.g., Apple iTunes Search API) and local file system access for processing data via the
scripts/competitive_matrix_builder.pyscript. - Sanitization: No explicit sanitization or validation logic is provided to filter the content retrieved from external sources before it is analyzed by the agent.
Audit Metadata