competitor-profiling
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
playwrightlibrary and Chromium browser binaries from the official NPM registry and Microsoft distribution servers to facilitate live site rendering and analysis.\n- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to install required Node.js packages and run a local JavaScript file (analyze.js) for extracting data from websites.\n- [DATA_EXFILTRATION]: The skill is designed to scrape content from user-provided competitor URLs and save the raw data, including screenshots and JSON metadata, to the project's local directory.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes untrusted content from the web. Although it uses structured markdown templates for synthesis, it lacks explicit boundary markers or data sanitization for the scraped text, which could allow malicious website content to attempt to influence the agent's behavior.
Audit Metadata