product-discovery-ru
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its reliance on external, untrusted data sources.
- Ingestion points: Step 0.0 fetches content from user-provided URLs using
WebFetch. Step 4b utilizes thecommunity-signal-intelligence-agentto scrape data from Reddit, G2, Capterra, and various community forums. - Boundary markers: The instructions lack explicit delimitation or instructions for sub-agents to ignore potential command injections within the fetched data.
- Capability inventory: The system can perform file system writes (
~/.claude/discovery-profile.md) and network operations via MCP tools (Notion, Confluence). - Sanitization: There is no evidence of sanitization or validation of the fetched external content before it is passed through the agent chain.
- [COMMAND_EXECUTION]: The skill manages state through local file operations.
- It reads and writes company configuration data to
~/.claude/discovery-profile.md. - It utilizes a template file located at
~/.claude/discovery-profile.template.md. - [DATA_EXFILTRATION]: The skill is designed to collect internal data and export it to external services.
- It accesses sensitive internal systems including CRM, revenue metrics, and company wikis via the
internal-data-agentandproduct-knowledge-agent. - The resulting discovery reports are published to external platforms like Notion or Confluence using MCP tools, which involves sending aggregated company data to third-party domains.
Audit Metadata