competitor-intel

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the live web to generate intelligence reports.
  • Ingestion points: External data enters the context via nimble search and nimble extract commands executed in SKILL.md (Steps 3, 4, and 5).
  • Boundary markers: The skill enforces strict formatting rules for sub-agents (e.g., in references/competitor-agent-prompt.md) which requires specific key-value signal formats, acting as a structure-based boundary.
  • Capability inventory: The skill has access to tool capabilities including Bash, Write, Edit, and Agent calls.
  • Sanitization: A comprehensive Signal Validation phase (Step 5.5) is implemented to filter findings by event date and source quality, and it mandates multi-source corroboration for all high-priority (P1) signals.
  • [DYNAMIC_EXECUTION]: The skill generates and executes small Python scripts to manage its internal JSON configuration files.
  • Evidence: references/profile-and-onboarding.md provides a Python script template used to update business-profile.json. This is a routine method for state persistence within the agent's environment.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of the Nimble CLI from a public registry.
  • Evidence: references/profile-and-onboarding.md provides instructions for installing the @nimble-way/nimble-cli package via npm. This is a vendor-owned resource used for the skill's core functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:56 PM