mvpfy-market
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest and process information from external websites and user-provided URLs, which introduces a surface for indirect prompt injection. Attackers could place hidden instructions on webpages to manipulate the agent during research.
- Ingestion points: External URLs and competitor names provided by users in SKILL.md.
- Boundary markers: There are no explicit delimiters or instructions to ignore commands within retrieved external content.
- Capability inventory: The skill implies the use of search and web browsing tools to extract competitor data.
- Sanitization: No sanitization or filtering of external content is specified.
- [NO_CODE]: The skill package does not contain any executable code, scripts, or binaries, consisting only of markdown instructions and YAML configuration.
Audit Metadata