market
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external websites provided by the user. This data is untrusted and may contain hidden instructions (Indirect Prompt Injection) intended to manipulate the agent's output or behavior.
- Ingestion points: HTML, SEO data, and schema markup extracted from external URLs via
scripts/analyze_page.py(referenced inSKILL.md). - Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands within the fetched web content.
- Capability inventory: The skill can write multiple markdown files to the project root, execute Python scripts, and generate PDF files.
- Sanitization: No specific sanitization or validation logic is mentioned for the ingested external strings.\n- [EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of the
reportlablibrary usingpip3 install reportlab. This is a standard and well-known library used for generating PDF documents.\n- [COMMAND_EXECUTION]: The skill invokes several local Python scripts (analyze_page.py,competitor_scanner.py,social_calendar.py,generate_pdf_report.py) to perform its functions.
Audit Metadata