market-competitors
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts, specifically
scripts/analyze_page.pyandscripts/competitor_scanner.py, to parse and analyze the content of targeted URLs. These commands are directly related to the skill's functional purpose. - [EXTERNAL_DOWNLOADS]: The agent is instructed to fetch data from
web.archive.organd various competitor URLs to gather historical and current marketing intelligence. These network requests are necessary for the skill's operation. - [PROMPT_INJECTION]: The skill exhibits a vulnerability to indirect prompt injection because it ingests and processes untrusted data from external websites.
- Ingestion points: External competitor websites and archived page content from the Wayback Machine are fetched into the agent's context.
- Boundary markers: Absent; there are no explicit delimiters or instructions provided to the agent to disregard potential instructions embedded within the analyzed website data.
- Capability inventory: The skill possesses the capability to execute shell commands (via Python scripts) and perform web searches.
- Sanitization: No sanitization or filtering of the ingested external content is mentioned in the instruction set.
Audit Metadata