map-your-market
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill manages its workflow using local Python and shell commands.
- Instructions in
SKILL.mdusepython3to orchestrate input processing and report generation. - The skill executes
scripts/fetch.pyto perform the core data collection task. - It manages files in
/tmpand saves final research reports to thedocs/market-maps/folder. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to collect market signals from public platforms.
- It connects to
www.reddit.com,hn.algolia.com,api.github.com, andwww.g2.comusing the standard Pythonurlliblibrary. - Best Practice Violation: The
scripts/fetch.pyscript usesssl._create_unverified_context(), which disables SSL certificate verification for its network connections. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted user-generated content.
- Ingestion points: Data is fetched from Reddit posts, HN comments, and GitHub issues.
- Boundary markers: The collected data is analyzed by the AI without explicit delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill can execute local scripts and write files to the repository.
- Sanitization: Content is truncated for length but is not sanitized for malicious injection patterns.
Audit Metadata