competitor-launch-monitor
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted content from social media platforms (X, Reddit, LinkedIn, YouTube) and news sites, which presents an indirect prompt injection surface.
- Ingestion points: External data is ingested via unifapi tool calls in SKILL.md (Workflow Step 3) to fetch posts, comments, and news.
- Boundary markers: No explicit markers are defined for separating untrusted social content from instructions.
- Capability inventory: The skill is restricted to read-only operations and generating report text; it does not perform file writes or execute arbitrary code.
- Sanitization: No specific sanitization or filtering of the retrieved content is mentioned in the instructions.
- [EXTERNAL_DOWNLOADS]: The documentation provides installation instructions for the unifapi-agent/agents plugin and unifapi skill from the vendor's official resources.
- [DATA_EXFILTRATION]: The skill reads project-local context files (.agents/product-marketing.md) and reports usage billing information, which is standard functionality for this vendor's integrated tools.
Audit Metadata