competitor-profiling
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from external websites.
- Ingestion points: Data is pulled from external URLs via
firecrawl_scrape(SKILL.md). - Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the fetched content.
- Capability inventory: The skill writes extracted and synthesized data to the local file system in the
competitor-profiles/directory (SKILL.md). - Sanitization: No explicit sanitization of the scraped markdown content is performed before it is synthesized into profiles.
- [EXTERNAL_DOWNLOADS]: The skill interacts with external services to fulfill its purpose.
- Findings: It utilizes well-known services including Firecrawl and DataForSEO to perform web mapping, scraping, and SEO analysis (references/tool-reference.md).
Audit Metadata