competitor-teardown
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
infshcommand-line interface to perform market research tasks. Access is restricted via theallowed-toolsfrontmatter to theinfshcommand only. - [EXTERNAL_DOWNLOADS]: References installation instructions for the
infshCLI located atraw.githubusercontent.com/inference-sh/skills. It also suggests adding related modules usingnpx skills addfrom the same organization. - [REMOTE_CODE_EXECUTION]: Includes a Python script executed via the
infsh/python-executortool. This script usesmatplotlibto generate a positioning map image. The code is a static template provided within the skill instructions and does not incorporate unsanitized external inputs into the code structure. - [SAFE]: The skill processes untrusted data from external websites (via
agent-browserand search tools). While this represents a surface for indirect prompt injection, it is the primary intended function of a research skill. - Ingestion points: Competitor websites, G2/Capterra reviews, and search engine results.
- Boundary markers: None explicitly defined in the provided examples.
- Capability inventory: Web browsing (
agent-browser), file writing (python-executor), and network search (tavily,exa). - Sanitization: Standard tool-level sanitization is assumed; the skill itself does not implement additional filtering for retrieved content.
Audit Metadata