Competitor Spy Tool

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:07 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches its competitor-monitoring purpose, but it tells users to use rotating User-Agent headers and residential proxies when sites block automated requests.

Review before installing. Use it only for authorized monitoring of public pages, prefer official APIs or permissioned feeds, and stop or reduce scanning when a site returns 403 or 429 instead of using proxy or identity rotation. Treat Slack, Google Sheets, SerpAPI, Browserless, and automation integrations as external recipients of your monitoring targets and results.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:357

Finding

Guidance Encourages Circumvention of Target Access Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 357-362 and 373-375
Vulnerability Type: Access-control and rate-limit circumvention
Risk Level: Medium

Vulnerable Code Snippet:

text

### "Competitor Domain Returns 403/429"
**Problem:** Server is blocking automated requests.
**Solution:**
- Add rotating User-Agent headers
- Use residential proxy service (Bright Data, Smartproxy)
- Increase delay between requests
- Contact competitor's support if monitoring is legitimate

text

**Q: What if a competitor blocks my IP?**
A: Use a proxy rotation service or contact them directly—legitimate competitive monitoring is defensible.

Technical Analysis

HTTP 403 Forbidden and 429 Too Many Requests responses communicate that the target has denied access or imposed a request-rate limit. The Skill recommends changing User-Agent identities and routing requests through residential or rotating proxies after receiving these responses.

Rotating source IP addresses and client identities can defeat IP-based blocking, request quotas, and abuse-prevention controls. This advice conflicts with the Skill's earlier claims that it respects target rate limits and will not exceed ten requests per minute per domain.

The issue does not directly elevate local operating-system privileges. Instead, it enables continued remote access beyond the level permitted by the target service's controls.

Attack Path

1. The Skill sends automated monitoring requests to a competitor website.
2. The target detects or limits the automation and returns a 403 or 429 response.
3. The operator follows the documented troubleshooting guidance.
4. Requests are routed through residential or rotating proxy addresses, and User-Agent values are changed.
5. The target sees the requests as originating from different clients or networks.
6. IP-based blocks or rate limits may consequently be bypassed, allowing monit ...[truncated 752 chars]

Remediation

View remediation

Remediation Suggestions

• Remove recommendations to rotate User-Agent identities or use residential and rotating proxies in response to blocking.
• Treat 403 responses as a hard stop for automated monitoring unless the target explicitly authorizes access.
• Honor 429 responses and the Retry-After header.
• Implement exponential backoff with a conservative maximum retry count.
• Maintain per-domain request budgets and disable monitoring when repeated denial responses occur.
• Require documented authorization before enabling proxy-based collection.
• Record response codes, retry decisions, and operator approvals in an audit log.
• Amend the troubleshooting guidance to recommend reducing frequency, using an authorized API, or contacting the website owner.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:179

Finding

Unquoted Environment Variables Are Passed to Curl

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 179-181, 332-334, and 353-355
Vulnerability Type: Unsafe shell argument construction
Risk Level: Medium

Vulnerable Code Snippet:

bash

curl -X POST $SLACK_WEBHOOK_URL \
  -H 'Content-Type: application/json' \
  -d '{"text":"Competitor Spy Tool initialized ✅"}'

bash

curl -X POST $SLACK_WEBHOOK_URL \
  -H 'Content-Type: application/json' \
  -d '{"text":"Test message"}'

bash

curl -X POST https://sheets.googleapis.com/v4/spreadsheets/$GOOGLE_SHEET_ID/values/Sheet1!A1:append \
  -H "Authorization: Bearer $GOOGLE_SHEETS_API_KEY" \
  -d '{"values":[["Test","Data"]]}'

Technical Analysis

The examples expand SLACK_WEBHOOK_URL and GOOGLE_SHEET_ID without shell quoting. In POSIX-style shells, an unquoted expansion is subject to word splitting and pathname expansion. A value containing whitespace can therefore become multiple arguments to curl.

Because curl accepts options throughout its argument list, additional words beginning with - may be interpreted as options rather than URL data. If an attacker or untrusted configuration source can influence one of these environment variables, the documented command may perform requests or file operations beyond those intended by the operator.

The Sheets example also uses GOOGLE_SHEETS_API_KEY as an OAuth Bearer credential. Google API keys and OAuth access tokens are different credential types. This example encourages incorrect authentication handling and may result in users placing sensitive token material in a misleadingly named variable.

Attack Path

1. An attacker or untrusted deployment mechanism influences SLACK_WEBHOOK_URL or GOOGLE_SHEET_ID.
2. The value is crafted to contain whitespace followed by one or more valid curl options or additional URLs.
3. An operator or Agent executes the command copied from SKILL.md.
4. The shell splits the unqu ...[truncated 1298 chars]

Remediation

View remediation

Remediation Suggestions

• Quote every environment-variable expansion:

  bash

  curl --request POST \
    --url "$SLACK_WEBHOOK_URL" \
    --header 'Content-Type: application/json' \
    --data '{"text":"Competitor Spy Tool initialized ✅"}'
  

• Construct and validate the Sheets URL before passing it to curl:

  bash

  case "$GOOGLE_SHEET_ID" in
    (*[!A-Za-z0-9_-]*|'')
      printf '%s\n' 'Invalid Google Sheet ID' >&2
      exit 1
      ;;
  esac
  
  sheets_url="https://sheets.googleapis.com/v4/spreadsheets/${GOOGLE_SHEET_ID}/values/Sheet1!A1:append"
  
  curl --request POST \
    --url "$sheets_url" \
    --header "Authorization: Bearer $GOOGLE_OAUTH_ACCESS_TOKEN" \
    --header 'Content-Type: application/json' \
    --data '{"values":[["Test","Data"]]}'
  

• Validate that Slack webhook destinations use HTTPS and match the expected hooks.slack.com hostname before sending data.

• Reject control characters, whitespace, option-like values, and unexpected URL schemes in configuration values.

• Use a correctly obtained, short-lived OAuth access token or service-account flow for Google Sheets authorization.

• Do not describe a Google API key as a Bearer token.

• Store credentials in a managed secret store, restrict their environment exposure, and rotate any credential suspected of disclosure.

• Run network commands with the minimum necessary filesystem and network privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

EBHOOK_URL"],"bins":["curl","grep"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"🕵️"}}

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill’s safety section claims it respects robots.txt, Terms of Service, and avoids bypassing protections, but the troubleshooting section recommends evasive anti-blocking tactics such as rotating User-Agent headers and residential proxies. This is dangerous because it normalizes circumventing access controls and can enable sustained unauthorized scraping after a target has signaled blocking or non-consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation says the tool will not bypass CAPTCHA or protected content, yet later advises rotating headers and proxies when competitor servers block automated requests. Even if CAPTCHA is not explicitly bypassed, these techniques are commonly used to evade anti-bot controls and undermine the stated guardrails.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to use the skill whenever the user needs 'competitive intelligence, market tracking, or SEO monitoring across multiple domains,' which is a wide natural-language trigger surface rather than a specific invocation scope. It does not provide exclusion conditions or negative examples, so ordinary research or SEO requests could unintentionally match this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill promotes integrations with SerpAPI, Slack, and Google Sheets but does not clearly warn users up front that monitored data and derived intelligence may be transmitted to third-party services. This can lead to unintentional disclosure of business-sensitive monitoring targets, findings, or internal strategy context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

4. Test Connection:

   bash

   curl -X POST $SLACK_WEBHOOK_URL \
     -H 'Content-Type: application/json' \
     -d '{"text":"Competitor Spy Tool initialized ✅"}'
   

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.

Solution:

bash

# Test webhook
curl -X POST $SLACK_WEBHOOK_URL \
  -H 'Content-Type: application/json' \
  -d '{"text":"Test message"}'

Static analysis

No suspicious patterns detected.