competitor-intel
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the live web to generate intelligence reports.
- Ingestion points: External data enters the context via
nimble searchandnimble extractcommands executed inSKILL.md(Steps 3, 4, and 5). - Boundary markers: The skill enforces strict formatting rules for sub-agents (e.g., in
references/competitor-agent-prompt.md) which requires specific key-value signal formats, acting as a structure-based boundary. - Capability inventory: The skill has access to tool capabilities including
Bash,Write,Edit, andAgentcalls. - Sanitization: A comprehensive
Signal Validationphase (Step 5.5) is implemented to filter findings by event date and source quality, and it mandates multi-source corroboration for all high-priority (P1) signals. - [DYNAMIC_EXECUTION]: The skill generates and executes small Python scripts to manage its internal JSON configuration files.
- Evidence:
references/profile-and-onboarding.mdprovides a Python script template used to updatebusiness-profile.json. This is a routine method for state persistence within the agent's environment. - [EXTERNAL_DOWNLOADS]: The skill references the installation of the Nimble CLI from a public registry.
- Evidence:
references/profile-and-onboarding.mdprovides instructions for installing the@nimble-way/nimble-clipackage vianpm. This is a vendor-owned resource used for the skill's core functionality.
Audit Metadata