track-startup-competitors
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Node.js utility scripts (compare_snapshots.mjs, export_evidence.mjs, generate_report.mjs) for data analysis and reporting tasks. These scripts are bundled with the skill and operate on local JSON data files using standard Node.js file system modules.
- [PROMPT_INJECTION]: The skill is designed to ingest and process content from various untrusted external websites and social media platforms, creating a surface for indirect prompt injection. This risk is addressed through extensive instructions on evidence verification, mandatory separation of facts from interpretation, and rigorous sanitization of external content within the report generator script using an escaping function to prevent XSS.
- [SAFE]: The skill includes a dedicated research-safety.md reference that strictly enforces a public-only boundary, explicitly forbidding the agent from bypassing authentication, paywalls, or robots.txt restrictions. It also emphasizes data privacy by directing the agent to redact personal information and avoid collecting non-essential personal identifiers during the monitoring process.
Audit Metadata