analyze-competitors
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
yt-dlp,ffmpeg, andcurlto download, process, and transcribe media files. - [EXTERNAL_DOWNLOADS]: Fetches media content from external social media platforms (YouTube, TikTok, Instagram) as part of its core analysis pipeline.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes untrusted data from external media content which could contain malicious instructions.
- Ingestion points: Video media downloaded via
yt-dlp, audio transcripts generated by the Whisper API, and opening frame text extracted viaffmpeg(SKILL.md, teardown.md). - Boundary markers: Absent; there are no specific instructions or delimiters to isolate untrusted external content from the agent's internal analysis logic.
- Capability inventory: Shell command execution for media tools (
yt-dlp,ffmpeg), network requests (curl), and local file writing (.json,.mp4,.jpg). - Sanitization: Absent; the skill extracts structure and hook information directly from raw external text and vision data without sanitization or filtering.
Audit Metadata