Competitor Analysis Report

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:36 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated competitor-reporting purpose, but it grants unrestricted Bash access that is not explained or needed for the workflow.

Install only if you are comfortable with the skill having shell-command capability in the agent environment. Before use, consider removing Bash from allowed-tools or running it in a restricted workspace, and check output/competitor-analysis/ for existing files because the skill uses fixed report filenames.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Overprivileged Bash Tool Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Read, Write, Edit, Grep, Glob, Bash, WebFetch, WebSearch

Technical Analysis

The skill grants unrestricted access to the Bash tool even though its documented workflow only requires collecting publicly available information and generating report files. No documented processing step requires arbitrary shell-command execution.

This violates the principle of least privilege. If attacker-controlled user input or externally retrieved research content influences tool selection, the agent could be induced to invoke shell commands unrelated to the legitimate reporting task. The actual effect would remain limited by the operating-system privileges and sandbox controls of the process running the agent.

Attack Path

1. An attacker supplies malicious instructions through a competitor name, input brief, or publicly accessible source encountered during research.
2. The agent processes that attacker-controlled content while executing the skill.
3. The malicious content directs the agent to invoke the permitted Bash tool.
4. The agent executes an arbitrary local command under its existing process identity.
5. The command accesses or modifies resources available to that identity, subject to applicable sandbox and operating-system restrictions.

This path depends on the agent following untrusted instructions; the reviewed file does not itself contain a malicious command or an explicit instruction to execute one.

Impact Assessment

Successful exploitation could permit arbitrary command execution with the privileges of the agent process. Depending on the runtime environment, this could allow reading or modifying accessible files, launching processes, changing generated output, or interacting with locally reachable serv ...[truncated 280 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash from allowed-tools because no documented workflow step requires shell execution.
2. Retain only the minimum tools needed for the task, such as web search or retrieval and narrowly scoped file-reading and file-writing capabilities.
3. Restrict write operations to output/competitor-analysis/.
4. Restrict read operations to explicitly supplied input files and approved project paths.
5. Treat web content and user-provided briefs as untrusted data, and prohibit instructions found in those sources from changing tool permissions or initiating local operations.
6. If shell access becomes necessary for a future feature, replace unrestricted Bash access with a constrained wrapper that uses fixed commands, validated arguments, an explicit working directory, execution timeouts, and sandboxing.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly directs the agent to write several files to disk under output/competitor-analysis/ without telling the user up front that filesystem writes will occur. While the destination is relatively constrained and aligned with the task, undisclosed file creation can still surprise users, overwrite prior outputs, or violate expectations in restricted environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.