ai-competitor-profiling
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources including user text, uploaded files, and external URLs (materialUrl). This represents an indirect prompt injection surface where malicious instructions in external content could attempt to influence the agent's analysis.
- Ingestion points: materialUrl, materialText, materialFile (defined in references/form-schema.json).
- Boundary markers: No specific delimiters or safety instructions are defined in the provided configuration to isolate untrusted content.
- Capability inventory: The skill communicates with the vendor API via the scripts/run.py execution script.
- Sanitization: No explicit sanitization or validation of the fetched/uploaded content is performed within the provided local scripts.
- [DATA_EXFILTRATION]: The skill utilizes the AISKILLS_API_KEY environment variable for authentication. The runner script correctly transmits this key via the X-API-Key header to the vendor's infrastructure at ai-skills.ai. This is a standard and expected authorization pattern for the service.
Audit Metadata