competitor-teardown

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These links direct you to install and run a CLI from an unfamiliar domain (inference.sh) with install steps hosted on raw.githubusercontent.com — a common vector for "curl | bash" or downloading/running unvetted binaries — which is potentially unsafe; the competitor.com pages themselves are benign but do not mitigate the risk of executing an unknown installer.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to run web searches and scrape/screenshot competitor websites (via infsh/agent-browser) and mine user-generated review sources like G2, Capterra, and Reddit, so it ingests untrusted third-party content that can steer analysis and subsequent actions.