The Agent Skills Directory

[SAFE]: The skill is entirely metadata and instruction-based, consisting of Markdown files that provide strategic frameworks (SWOT, 7 Powers, OSINT, etc.). It does not ship with any executable scripts, binaries, or configuration files that modify the system environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is designed to ingest external data from competitor websites and app stores via WebSearch and WebFetch tools. However, the skill's instructions explicitly mandate prompt-injection checks on all external content using platform-standard safety protocols (_common/WEB_FETCH_SAFETY.md). As this functionality is fundamental to the skill's purpose and includes safety checkpoints, it does not pose a significant risk.
[COMMAND_EXECUTION]: No instances of arbitrary command execution or the !command dynamic context syntax were detected in the skill's instructions. Mentions of subagent dispatch (e.g., in Multi-Engine mode) refer to platform-managed CLI adapters rather than direct shell execution by the skill.
[DATA_EXFILTRATION]: The analysis found no hardcoded credentials, sensitive file paths (such as SSH or AWS configurations), or suspicious network patterns. All data gathering is directed through standard research tools for public information.
[OBFUSCATION]: A thorough scan of the skill's Markdown files and reference templates confirmed the absence of obfuscation techniques such as Base64-encoded payloads, zero-width characters, or homoglyph-based attacks.

compete