competitive-teardown
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a systematic framework for business intelligence without any detected malicious code or instructions. The provided scripts are simple data processors using standard Python libraries.
- [INDIRECT_PROMPT_INJECTION]: The skill incorporates external information from competitor websites and user review platforms, creating a potential surface for indirect prompt injection.
- Ingestion points: Data collection from external sources like G2, Capterra, and LinkedIn as specified in SKILL.md.
- Boundary markers: The instructions do not define explicit security boundaries or instructions to ignore data-embedded commands.
- Capability inventory: The scripts battle_card_generator.py, competitor_scorer.py, and feature_matrix_builder.py only perform local JSON processing and report generation. They lack network access, file writing, or command execution capabilities.
- Sanitization: No explicit sanitization or filtering of the ingested external content is observed in the processing scripts.
Audit Metadata