competitor-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill utilizes documented HarborRank MCP tools and vendor domains (harborrank.com) to perform its core SEO research functions.
- [SAFE]: Privacy guardrails are integrated into the workflow, specifically requiring user permission before publishing data to external links via create_share_report and filtering sensitive Search Console or Google Analytics data.
- [SAFE]: Financial and usage controls are included, instructing the agent to verify credit balances via whoami and seek user approval before making paid research calls.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data from external websites. 1. Ingestion points: Fallback mode reads competitor website content including navigation, blogs, and sitemaps. 2. Boundary markers: Absent; the instructions do not include specific delimiters or warnings to ignore instructions found within external site data. 3. Capability inventory: The skill uses MCP tools for SEO research, writes reports to the local file system, and can publish reports to a web URL. 4. Sanitization: No explicit sanitization of external data is specified in the prompt instructions.
Audit Metadata