competitor-analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow involves scraping or fetching arbitrary competitor web pages, search results, and external marketing content (via WebFetch, ScrapingBee, and SerpAPI), which allows potential indirect prompt injection from external sources.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill contains curl commands fetching data from external API domains (semrush.com, serpapi.com, and scrapingbee.com) used as operational configuration and instructions, which represent weak/unknown provenance third-party dependencies.