competitive-teardown
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified in the skill logic or scripts.
- [EXTERNAL_DOWNLOADS]: The skill instructions provide example API calls to the Apple iTunes Search API for review collection. This is a well-known service and the reference is neutrally documented.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to process untrusted external data from sources like app store reviews and social media mentions. Evidence chain: 1) Ingestion points: SKILL.md (Workflow Step 2) and references/data-collection-guide.md. 2) Boundary markers: No specific delimiters or instructions to ignore embedded commands are present. 3) Capability inventory: The skill utilizes a local scoring script scripts/competitive_matrix_builder.py and mentions interacting with external APIs (e.g., iTunes Search API). 4) Sanitization: No explicit content sanitization or validation of the ingested text is documented.
Audit Metadata