local-competitor-scan
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to the UnifAPI MCP server (mcp.unifapi.com) to fetch live search and map data via OAuth. These are vendor-owned resources required for the skill's core functionality.
- [COMMAND_EXECUTION]: The documentation provides instructions for installing the skill using npx and a plugin manager. These commands facilitate the deployment of the vendor's tools within the user's environment.
- [PROMPT_INJECTION]: The skill ingests untrusted data from external search engine results and map listings, which presents a surface for indirect prompt injection.
- Ingestion points: Untrusted data is retrieved through the local/search, maps/search, and seo/serp tool outputs as described in SKILL.md.
- Boundary markers: No specific delimiters or instructions to ignore potentially malicious instructions embedded in the search results are provided.
- Capability inventory: The skill is limited to analyzing data and generating markdown reports; it does not possess capabilities for file-system modification, subprocess execution, or arbitrary outbound network requests beyond the established tool definitions.
- Sanitization: There is no instruction to sanitize or escape the content of the search results before including them in the final report.
Audit Metadata