competitor-alternatives
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from
competitors.jsonand.claude/product-marketing-context.mdto generate comparison matrices and marketing copy. - Ingestion points: Structured data files (
competitors.json) and project context files. - Boundary markers: The instructions do not define specific delimiters for untrusted data interpolation.
- Capability inventory: The skill uses a local Python script for data processing and generates Markdown content for the user.
- Sanitization: The Python script validates JSON structure, but does not explicitly sanitize content for LLM instructions.
- [COMMAND_EXECUTION]: The skill utilizes a local helper script,
scripts/comparison_matrix_builder.py, to generate comparison tables. The script is written using only the Python standard library, performs no network operations, and does not access sensitive system paths. It serves a legitimate, narrow purpose within the skill's marketing workflow.
Audit Metadata