competitor-signals
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to well-known public APIs, including Product Hunt (GraphQL) and Hacker News (Algolia), to retrieve engagement data such as comments and upvotes.
- [COMMAND_EXECUTION]: Executes a local Python utility (
scripts/competitor_signals.py) to process retrieved data, calculate signal scores, and generate CSV output. - [PROMPT_INJECTION]: The skill processes untrusted user-generated content from external platforms (Product Hunt and Hacker News comments). This represents a surface for indirect prompt injection where malicious content in comments could attempt to influence the agent's analysis.
- Ingestion points: Public comments and website text retrieved via the
WebFetchtool and the Python processing script. - Boundary markers: None explicitly defined in the prompt instructions when the agent evaluates the processed results.
- Capability inventory: The agent utilizes
Bash,Write, andEdittools to manage the configuration and output files. - Sanitization: The Python script implements basic HTML tag stripping to clean scraped content before processing.
Audit Metadata