competitor-tracking
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially contain malicious instructions.
- Ingestion points: The skill fetches app metadata (titles, descriptions) and user reviews via the Appeeky API (SKILL.md).
- Boundary markers: There are no explicit instructions or delimiters to isolate this external content from the agent's core logic.
- Capability inventory: The agent uses MCP tools (get_app, get_app_keywords, get_app_reviews) to interact with the external API and perform analysis.
- Sanitization: No explicit sanitization or filtering of the fetched content is specified in the skill.
- [EXTERNAL_DOWNLOADS]: The skill fetches application data from the vendor's API.
- Evidence: The skill references https://api.appeeky.com/v1/apps/ for retrieving app details and metadata.
Audit Metadata