competitor-profiling
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the unifapi toolset to retrieve data from mcp.unifapi.com. This is a vendor-controlled endpoint used to aggregate public SEO, social, and web data for research purposes.- [COMMAND_EXECUTION]: The installation instructions include npx skills add unifapi-agent/agents. This is a standard procedure for adding agent skills to supported platforms.- [DATA_EXFILTRATION]: The skill is instructed to read local context files, such as .agents/product-marketing.md, to align its competitive research with the user's own product positioning. This access is consistent with the primary purpose of the skill.- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it processes untrusted content from the public web and social media. 1. Ingestion points: The skill retrieves external data using tools like browser/markdown and various social media API wrappers (X, Reddit, LinkedIn). 2. Boundary markers: The prompt instructions do not include explicit delimiters or specific instructions to the model to ignore executable patterns found within the scraped data. 3. Capability inventory: The skill focuses on data retrieval and reporting; it does not request high-risk permissions like arbitrary shell execution or file-system writing. 4. Sanitization: No explicit data sanitization or filtering of the ingested content is mentioned in the instructions.
Audit Metadata