competitor-profiling
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external competitor websites via scraping tools. It proactively mitigates the risk of indirect prompt injection through a dedicated 'Untrusted Input' section in the core principles. This section explicitly instructs the agent to treat all scraped content as data to be analyzed rather than instructions to be followed, and specifically warns about hidden HTML directives or text aimed at AI agents.
- [EXTERNAL_DOWNLOADS]: The skill integrates with well-known third-party services, including Firecrawl for web scraping and DataForSEO for market intelligence. These tools are used to retrieve public marketing and SEO data relevant to the skill's primary function. The usage is consistent with the stated purpose of competitive research.
- [COMMAND_EXECUTION]: The skill defines a structured research process that involves calling specific tools (e.g.,
firecrawl_map,firecrawl_scrape,backlinks_summary). There is no evidence of arbitrary command execution or shell injection vulnerabilities. The input URLs are used as parameters for these dedicated scraping and SEO tools.
Audit Metadata