competitor-teardown

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the belt CLI (a vendor-provided tool) to execute various research and analysis tasks, such as web searching and browser automation.
  • [EXTERNAL_DOWNLOADS]: References a CLI installation script from the official inference-sh GitHub repository (raw.githubusercontent.com/inference-sh/skills/). This is a trusted vendor resource.
  • [DYNAMIC_EXECUTION]: Includes a Python code snippet designed to run within the vendor's python-executor app. The code utilizes matplotlib to generate and save a visual positioning map as an image file. This is standard functionality for the skill's primary purpose of data visualization.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, including competitor websites, pricing pages, and third-party review platforms (G2, Capterra, Reddit).
  • Ingestion points: External data is ingested via tavily/extract, tavily/search-assistant, and infsh/agent-browser (SKILL.md).
  • Boundary markers: None explicitly defined in the provided instructions to delimit external content from system instructions.
  • Capability inventory: The skill has the capability to write files (image generation), perform network operations (via belt apps), and execute code (via python-executor).
  • Sanitization: No specific sanitization or filtering of external content is mentioned, which is a common characteristic of research-oriented skills.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:24 AM
Security Audit — agent-trust-hub — competitor-teardown