Competitive Intelligence

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:17 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent competitive-research workflow, but its command templates put user-provided names and URLs into shell commands without safety guidance.

Review before installing. The skill's research goal is legitimate, but it should be used only by agents that pass search terms and URLs as structured arguments or carefully validate and quote them, especially if competitor names or URLs come from untrusted input.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:40

Finding

Shell Command Injection Through Unsanitized User-Controlled Placeholders

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–100
Vulnerability Type: Shell command injection
Risk Level: High

The Skill instructs the Agent to interpolate user-derived product categories, company names, competitor names, and competitor URLs directly into shell commands.

bash

node tools/clis/exa.js search "[product category] competitors 2025 2026" --num-results 10

bash

node tools/clis/exa.js search "best [product category] tools comparison" --num-results 5

bash

node tools/clis/exa.js search "alternatives to [company name]" --num-results 5

bash

node tools/clis/exa.js search "[competitor] company" --num-results 5

bash

node tools/clis/exa.js search "[competitor] pricing plans" --num-results 5

bash

node tools/clis/exa.js search "[competitor] product updates 2025 2026" --num-results 5

bash

node tools/clis/exa.js search "[competitor] reviews pros cons" --num-results 5

bash

node tools/clis/firecrawl.js scrape [competitor-url]/pricing

bash

node tools/clis/firecrawl.js scrape [competitor-url]/features

bash

node tools/clis/firecrawl.js scrape [competitor-url]/about

bash

node tools/clis/firecrawl.js scrape [competitor-url]/changelog

Technical Analysis

The documented workflow does not require validation, escaping, or shell-free argument handling before substituting user-controlled values into command templates.

The search parameters are enclosed in double quotes, but double quotes do not suppress every form of shell interpretation. In common shells, constructs such as command substitution remain active inside double-quoted strings. The competitor URL placeholders are not quoted at all, increasing exposure to shell metacharacters, token splitting, redirection, pipelines, and command separators.

The vulnerability becomes exploitable when an Agent follows these templates by constructing a command string and passing it to a shell. A malicious product ca ...[truncated 1804 chars]

Remediation

View remediation

Remediation Suggestions

1. Prohibit shell-string construction

   • Do not concatenate or interpolate user-controlled values into executable shell text.
   • Invoke the Node.js executable through a process API that accepts an executable and a separate argument array.
   • Explicitly disable shell execution, such as by using shell: false.

2. Validate every dynamic value

   • Enforce reasonable length limits and reject control characters.
   • Treat product, company, and competitor names strictly as data.
   • Parse competitor URLs with a standard URL parser.
   • Permit only expected http: and https: schemes.
   • Reject embedded credentials and unexpected URL forms where they are unnecessary.

3. Pass URLs as discrete arguments

   • Construct URL paths with a URL API rather than appending strings in a shell command.
   • Pass the resulting URL to Firecrawl as one process argument.

4. Add explicit Skill-level safety instructions

   • State that placeholders must never be replaced inside a shell command string.
   • Require structured tool invocation or shell-free subprocess execution.
   • Require confirmation or rejection when supplied values contain shell metacharacters or control characters.

5. Apply least privilege

   • Run research tools in a restricted environment with minimal filesystem access.
   • Avoid exposing unrelated secrets through environment variables.
   • Restrict outbound network access to services required for the research task.

6. Add security tests

   • Test values containing spaces, quotes, dollar signs, parentheses, semicolons, pipes, redirection characters, newlines, and command-substitution syntax.
   • Verify that all such values are either rejected or passed unchanged as a single non-shell argument.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.