competitor-data-verifier
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from competitor websites through WebFetch and WebSearch tools.
- Ingestion points: External web content is retrieved from competitor URLs (e.g., pricing and documentation pages) based on competitor names found in local data files.
- Boundary markers: No specific delimiters or "ignore previous instructions" warnings are used when passing the scraped content to the agent context.
- Capability inventory: The skill's tools are limited to reading local files (Read, Glob) and performing network requests (WebSearch, WebFetch); it lacks capabilities for file-writing, command execution, or dynamic code evaluation.
- Sanitization: There is no evidence of sanitization or filtering of the ingested web content before it is processed for reporting.
Audit Metadata