company-radar

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, including GitHub, Twitter, Reddit, Hacker News, Product Hunt, and YC Jobs, which is then synthesized into AI-generated executive briefings.
  • Ingestion points: External platform data is retrieved via Tavily search and specialized micro-skills (e.g., reddit-icp-monitor) as defined in SKILL.md and references/skill-integration-map.md.
  • Boundary markers: The skill utilizes a structured report template (references/radar-report-template.md) to organize output, though it lacks explicit instructions for the AI to ignore instructions potentially embedded in the fetched data.
  • Capability inventory: The skill has the ability to execute shell commands (node scripts/heat-score-calc.mjs) and orchestrate other micro-skills to perform network and file operations.
  • Sanitization: There is no evidence of explicit sanitization or filtering logic for the external content before it is processed by the AI for synthesis.
  • [COMMAND_EXECUTION]: The orchestration pipeline involves executing a local JavaScript utility, scripts/heat-score-calc.mjs, via the node runtime to process collected signal data and calculate company heat scores.
  • [EXTERNAL_DOWNLOADS]: The documentation references installation via npx @opendirectory.dev/skills and suggests downloading components from the Varnan-Tech/opendirectory GitHub repository, which are author-controlled resources.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 02:06 PM