competitive-teardown
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions embedded by third parties (e.g., in app reviews or social media posts).
- Ingestion points: The skill ingests raw text from the iTunes Search API (
itunes.apple.com/rss/customerreviews), job postings, and social media platforms (Twitter/X, Reddit) as described inSKILL.mdandreferences/data-collection-guide.md. - Boundary markers: There are no explicit instructions to wrap the gathered competitor data in delimiters or to instruct the model to ignore any embedded commands within the ingested reviews.
- Capability inventory: The ingested data is used to populate competitive intelligence templates and is processed by
scripts/competitive_matrix_builder.pyto generate numeric scorecards and rankings. - Sanitization: No methods for sanitizing, filtering, or escaping content from external reviews are provided in the instructions.
Audit Metadata