competitor-tracking

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill makes network requests to api.appeeky.com to retrieve competitive intelligence data. This domain is not on the standard whitelisted list.
  • [DYNAMIC_EXECUTION]: The skill provides a bash script template for semi-automating API calls. This script is generated at runtime using user-supplied App IDs and is designed to be executed in the user's environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted data from external sources (competitor app titles, descriptions, and user reviews) and processes it for summarization.
  • Ingestion points: External app store metadata and reviews fetched via the Appeeky API.
  • Boundary markers: The instructions do not specify any delimiters or safety markers to prevent the agent from interpreting text within these fields as commands.
  • Capability inventory: The skill possesses the capability to generate and suggest the execution of shell scripts using curl and jq.
  • Sanitization: No sanitization or validation of the fetched external text strings is implemented or required by the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 02:33 PM