Phy Competitor Watch

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 9:15 PM UTC
• Version: 1.0.3

Overview

This skill is a local competitor-content analyzer with no network, credential, persistence, or system-modifying behavior, though users should treat imported post text as untrusted.

Install only if you are comfortable analyzing competitor post exports locally. Prefer trusted JSON inputs, avoid viewing reports from hostile scraped content in a sensitive terminal, and use the insights for lawful benchmarking and differentiation rather than deceptive or abusive targeting.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/competitor_watch.py:216

Finding

Terminal Control-Sequence Injection Through Untrusted Report Content

Content

View full analysis

Vulnerability Details

File Location: scripts/competitor_watch.py:216 and scripts/competitor_watch.py:248-250
Vulnerability Type: Improper neutralization of terminal control sequences
Risk Level: Medium

The text report writes attacker-controlled competitor names and post content directly to the terminal without removing ANSI escape sequences or other control characters.

python

w(f"  phy-competitor-watch — {profile.name} Content Analysis")

python

for i, p in enumerate(profile.top_posts, 1):
    preview = p.text[:80].replace("\n", " ")
    w(f"  {i}. [{p.engagement}] {preview}...")
    w(f"     Topics: {', '.join(p.topics)} | Style: {', '.join(p.styles)}")

Technical Analysis

profile.name originates from the user-controlled --name command-line argument. The value of p.text originates from the supplied JSON document. Both values can therefore contain arbitrary terminal control characters.

The post preview removes newline characters, but it does not remove escape characters, ANSI control sequences, C0/C1 control characters, or terminal-specific Operating System Command sequences. When print(format_report(profile)) sends the generated report to an interactive terminal, the terminal can interpret these bytes as commands instead of displaying them as ordinary text.

Depending on terminal capabilities and configuration, crafted input could clear or rewrite displayed output, move the cursor, forge apparently legitimate report or shell content, create deceptive hyperlinks, alter the window title, or interact with terminal features such as clipboard control. The script itself does not pass this content to a shell and does not provide a demonstrated arbitrary-code-execution primitive.

Attack Path

Competitor-name vector:

1. An attacker or untrusted caller supplies a crafted --name value containing terminal escape sequences.
2. The value is stored as profile.name.
3. `f ...[truncated 1558 chars]

Remediation

View remediation

Remediation Suggestions

Sanitize every untrusted value before writing it to a terminal, including profile.name, post previews, and any future fields derived from imported data.

1. Remove ANSI escape sequences, C0/C1 control characters, and terminal-specific command sequences.
2. Preserve only explicitly permitted whitespace, such as ordinary spaces and tabs.
3. Apply sanitization at the terminal-output boundary rather than relying on individual callers.
4. Keep JSON output available for machine processing, while ensuring downstream renderers safely escape untrusted strings.
5. Add regression tests containing CSI, OSC, carriage return, backspace, and other control characters.

Example hardening:

python

ANSI_ESCAPE = re.compile(
    r"\x1b(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])"
)

def safe_terminal(value: str) -> str:
    value = ANSI_ESCAPE.sub("", value)
    return "".join(
        character
        for character in value
        if character == "\t" or ord(character) >= 0x20
    )

Use the sanitizer for every user-derived terminal field:

python

safe_name = safe_terminal(profile.name)
w(f"  phy-competitor-watch — {safe_name} Content Analysis")

preview = safe_terminal(p.text[:80].replace("\n", " "))
w(f"  {i}. [{p.engagement}] {preview}...")

For stronger guarantees, replace disallowed characters with visible escaped representations such as \x1b rather than silently deleting them. Consider a well-tested terminal sanitization implementation if reports may process fully hostile input.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s own description explicitly frames the output as identifying 'exploitable gaps' in a competitor’s strategy. While not a software exploit, this is adversarial guidance aimed at targeting a third party and lacks any neutral, ethical, or compliant framing, which makes the behavior materially risky in an agent setting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The generated report repeatedly instructs the user to exploit topics and styles a competitor does not cover, and the 'Actionable Intel' section encourages directly weaponizing the analysis against that competitor. In the context of an agent skill, this operationalizes adversarial targeting rather than providing neutral analytics, increasing the chance of misuse for manipulative or unfair competitive conduct.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.