competitor-profiling

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches website content and marketing data from external domains using Firecrawl and DataForSEO. These operations are essential for the skill's primary function of competitive intelligence and utilize well-known services.
  • [PROMPT_INJECTION]: Contains a surface for indirect prompt injection because the skill ingests and processes untrusted content from scraped competitor websites. Ingestion points: External website content fetched via Firecrawl (SKILL.md). Boundary markers: None identified; instructions do not explicitly mandate ignoring embedded instructions within the scraped data. Capability inventory: File system write operations to create markdown profiles in the competitor-profiles/ directory (SKILL.md). Sanitization: No explicit sanitization or validation of the scraped text is described before synthesis into profiles.
  • [DATA_EXPOSURE]: Accesses the local project file .agents/product-marketing-context.md (or .claude/product-marketing-context.md) to gather existing context about the user's product. This is a restricted local read operation intended to improve the relevance of the generated profiles.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 04:29 AM