competitor-tracking
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill makes network requests to
api.appeeky.comto retrieve competitive intelligence data. This domain is not on the standard whitelisted list. - [DYNAMIC_EXECUTION]: The skill provides a bash script template for semi-automating API calls. This script is generated at runtime using user-supplied App IDs and is designed to be executed in the user's environment.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted data from external sources (competitor app titles, descriptions, and user reviews) and processes it for summarization.
- Ingestion points: External app store metadata and reviews fetched via the Appeeky API.
- Boundary markers: The instructions do not specify any delimiters or safety markers to prevent the agent from interpreting text within these fields as commands.
- Capability inventory: The skill possesses the capability to generate and suggest the execution of shell scripts using
curlandjq. - Sanitization: No sanitization or validation of the fetched external text strings is implemented or required by the instructions.
Audit Metadata