competitor-teardown
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
beltCLI (a vendor-provided tool) to execute various research and analysis tasks, such as web searching and browser automation. - [EXTERNAL_DOWNLOADS]: References a CLI installation script from the official inference-sh GitHub repository (
raw.githubusercontent.com/inference-sh/skills/). This is a trusted vendor resource. - [DYNAMIC_EXECUTION]: Includes a Python code snippet designed to run within the vendor's
python-executorapp. The code utilizesmatplotlibto generate and save a visual positioning map as an image file. This is standard functionality for the skill's primary purpose of data visualization. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, including competitor websites, pricing pages, and third-party review platforms (G2, Capterra, Reddit).
- Ingestion points: External data is ingested via
tavily/extract,tavily/search-assistant, andinfsh/agent-browser(SKILL.md). - Boundary markers: None explicitly defined in the provided instructions to delimit external content from system instructions.
- Capability inventory: The skill has the capability to write files (image generation), perform network operations (via belt apps), and execute code (via python-executor).
- Sanitization: No specific sanitization or filtering of external content is mentioned, which is a common characteristic of research-oriented skills.
Audit Metadata