Security audit

Competitor Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed competitor influencer-marketing analysis template, with some scope ambiguity around creator prospecting but no evidence of hidden, destructive, or deceptive behavior.

Install only if you want competitor influencer-marketing analysis that may retain reports and named creator observations in memory. Use it with public or authorized data, verify estimates before acting on them, and treat the creator-opportunity sections as competitive intelligence unless the publisher clarifies that creator prospecting is fully in scope.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The manifest explicitly says this skill is 'Not for finding your own new creators — use influencer-discovery,' but this template directs the skill to produce 'Untapped Influencers' and 'Former Competitor Partners (available),' which is effectively prospecting for recruitable creators. That capability is not justified as mere competitor analysis because it identifies candidate influencers for the user's own program.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation says the skill is for 'Identifying saturated vs. available influencers,' which conflicts with the manifest's instruction that the skill is not for finding your own new creators. This is an active intent-level contradiction in the skill's own reference documentation, not just an omitted limitation.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: This markdown file describes tracking competitors' influencer partnerships and identifying specific influencers, including handles, relationship history, and estimated spend, but it does not warn users that the workflow may involve collecting and reporting identifiable third-party data. For a skill centered on monitoring named individuals and competitive intelligence, a brief disclosure about privacy, data sourcing, and responsible use would materially improve user awareness.

Static analysis

No suspicious patterns detected.