competitor-post-engagers
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted content from LinkedIn comments, which presents an indirect prompt injection surface.
- Ingestion points: User-generated comments are retrieved from LinkedIn via Apify and ingested by the
competitor_post_engagers.pyscript. - Boundary markers: The script does not use specific delimiters or instructions to treat the ingested comment text as data rather than instructions.
- Capability inventory: The skill has network access for API communication and local file-writing capabilities for generating reports.
- Sanitization: Comment text is truncated for length but is not sanitized for potential malicious instruction patterns.
- [DATA_EXFILTRATION]: The skill collects public LinkedIn profile data, reactions, and comments to identify potential leads. This data is exported to a local CSV file, which is the primary intended functionality of the skill and is done at the user's request.
Audit Metadata