competitor-post-engagers
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to run a local Python script (competitor_post_engagers.py) to execute its logic.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests and processes untrusted data from an external social media platform.
- Ingestion points: Data including headlines and comments is fetched from Apify datasets via the apify_dataset function in scripts/competitor_post_engagers.py.
- Boundary markers: There are no explicit markers or instructions to the model to ignore embedded commands in the ingested data.
- Capability inventory: The skill's scripts perform file-system writes (to create CSV and debug files) and network operations (communication with Apify and Apollo).
- Sanitization: The script utilizes the Python csv module, which provides standard escaping for special characters, mitigating risks when the output is consumed by other software.
Audit Metadata