company-radar
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, including GitHub, Twitter, Reddit, Hacker News, Product Hunt, and YC Jobs, which is then synthesized into AI-generated executive briefings.
- Ingestion points: External platform data is retrieved via Tavily search and specialized micro-skills (e.g.,
reddit-icp-monitor) as defined inSKILL.mdandreferences/skill-integration-map.md. - Boundary markers: The skill utilizes a structured report template (
references/radar-report-template.md) to organize output, though it lacks explicit instructions for the AI to ignore instructions potentially embedded in the fetched data. - Capability inventory: The skill has the ability to execute shell commands (
node scripts/heat-score-calc.mjs) and orchestrate other micro-skills to perform network and file operations. - Sanitization: There is no evidence of explicit sanitization or filtering logic for the external content before it is processed by the AI for synthesis.
- [COMMAND_EXECUTION]: The orchestration pipeline involves executing a local JavaScript utility,
scripts/heat-score-calc.mjs, via thenoderuntime to process collected signal data and calculate company heat scores. - [EXTERNAL_DOWNLOADS]: The documentation references installation via
npx @opendirectory.dev/skillsand suggests downloading components from theVarnan-Tech/opendirectoryGitHub repository, which are author-controlled resources.
Audit Metadata