competitor-profiling
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted content from external websites via the Firecrawl tool to synthesize competitor profiles. This creates a vulnerability where malicious instructions embedded in a competitor's website could attempt to influence the agent's behavior during the analysis phase.
- Ingestion points: Scraped markdown content from various competitor pages (homepage, pricing, about, etc.) and SEO/market data fetched via DataForSEO.
- Boundary markers: The instructions do not define explicit delimiters or 'ignore' warnings for the agent when processing the external scraped markdown during the synthesis phase.
- Capability inventory: The agent has the capability to write and persist files to the local filesystem within the
competitor-profiles/directory. - Sanitization: No sanitization or validation of the scraped markdown content is performed before it is provided to the agent for synthesis.
- [EXTERNAL_DOWNLOADS]: The skill uses Firecrawl and DataForSEO to fetch data from external competitor URLs and SEO APIs. These are well-known technology services used according to their primary research purpose.
Audit Metadata