competitor-intel
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts provided within its directory structure (e.g.,
setup_competitor.py,run_daily.py) to manage competitor profiles and generate monitoring reports.\n- [DATA_EXFILTRATION]: Collected intelligence and reports are delivered to external email addresses using the 'AgentMail' service as a core notification feature.\n- [EXTERNAL_DOWNLOADS]: The skill fetches data from external social media sources (Reddit and Twitter) using the Apify API platform.\n- [PROMPT_INJECTION]: The skill ingests untrusted data from third-party social media platforms, which creates a surface for indirect prompt injection when this data is processed for reports.\n - Ingestion points: Raw content from Reddit and Twitter is scraped and stored in
competitor-intel/raw-data/.\n - Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded commands within the ingested data.\n
- Capability inventory: The skill is capable of executing local Python scripts and sending outbound emails via AgentMail.\n
- Sanitization: No evidence of input validation or content sanitization is described in the provided instructions.
Audit Metadata