gr-competitor-research

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze untrusted data from external sources, such as competitor websites (via Wayback Machine) and social media platforms (X/Twitter, LinkedIn, YouTube, TikTok). This creates an attack surface where malicious instructions embedded in these external sources could influence the agent's behavior during the research process.
  • Ingestion points: Research instructions in SKILL.md and reference READMEs (Steps 1, 2, and 6) direct the agent to fetch and teardown content from external URLs and social media posts.
  • Boundary markers: The instructions do not provide explicit delimiters or warnings to the agent to ignore instructions embedded within the analyzed content.
  • Capability inventory: The skill relies on the agent's default capabilities for web browsing, search, and data analysis to execute the SOP.
  • Sanitization: There are no instructions provided for sanitizing or filtering the content retrieved from external sources before processing.
  • [EXTERNAL_DOWNLOADS]: The skill references several well-known and reputable third-party services for competitive analysis, including the Wayback Machine (archive.org), SimilarWeb, and Semrush. These tools are standard for the described research tasks.
  • [SAFE]: The skill includes links to the author's own GitHub repository (github.com/Gingiris-1031) and profile on clawhub.ai. These are legitimate resources associated with the skill's developer.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 08:12 AM