competitive-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze data from the web, which introduces a surface for instructions embedded in external content to influence the agent.
- Ingestion points: External data is ingested during Phase 1 (Competitor Discovery) and Phase 3 (Feature & Pricing Matrix) via WebSearch and web-fetch tools from sources such as Product Hunt, G2, and Capterra.
- Boundary markers: The instructions lack explicit delimiters or boundary markers to isolate untrusted web content from the agent's instructions, and there is no directive for the agent to ignore instructions found within search results.
- Capability inventory: The skill uses informational tools (WebSearch, tavily, web-fetch) but does not utilize high-risk capabilities such as arbitrary code execution, file system modifications, or network exfiltration outside of its intended research scope.
- Sanitization: There is no mechanism described for sanitizing or validating retrieved content before it is processed into the final report.
Audit Metadata