The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from competitor websites to generate competitive analysis reports. Ingestion points: Website content is extracted using WebFetch and parallel Task agents in Phase 3 and Phase 6. Boundary markers: The skill uses XML schemas to structure extracted data, providing basic isolation, but content is not explicitly sanitized. Capability inventory: The agent has Bash (to run Node.js/Playwright), Write (to generate report files), and WebFetch capabilities. Sanitization: While the instructions emphasize verified data and citations, there is no explicit escaping of external content before it is interpolated into HTML templates for PDF generation via Playwright.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute its local Node.js script (screenshot.cjs) and Playwright for screenshot capture and report rendering. This execution is necessary for the skill's primary reporting functionality.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download its components from the vendor's GitHub repository using curl. As these downloads are from a well-known service (GitHub) and the vendor's official repository, they do not escalate the security verdict.

competitor-analysis-v2