competitive-intel-brief
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill demonstrates a surface for indirect prompt injection because it ingests untrusted data from multiple external sources, including Google Search, Reddit, and YouTube. This could allow malicious content on those platforms to attempt to influence the agent's behavior.
- Ingestion points: External web results and snippets retrieved via the Scavio API (SKILL.md, Step 1-4).
- Boundary markers: The skill uses structured markdown sections for output but does not define explicit delimiters to separate untrusted web content from agent instructions.
- Capability inventory: The skill performs network operations via the Scavio REST API (https://api.scavio.dev) to retrieve external data.
- Sanitization: No explicit sanitization or filtering of retrieved content is mentioned, though the skill instructs the agent to only use facts cited from URLs.
- [SAFE]: The skill uses a third-party service (Scavio) for market intelligence data. All referenced domains, including scavio.dev, scavio-ai.com, and the associated GitHub repository, are consistent with the provided author context and represent standard vendor functionality. Instructions to use environment variables for API keys follow security best practices.
Audit Metadata