other
- Location
SKILL.md:92- Finding
Deceptive Collection of Potentially Confidential Competitor Intelligence
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 92-98
Vulnerability Type: Deceptive social engineering and confidential business intelligence solicitation
Risk Level: MediumRelevant source segment, translated into English:
markdown - **Suppliers**: Information disclosed by shared suppliers - **Customers**: Customer feedback about competing products ### Frontline Intelligence - **Sales feedback**: Information collected by frontline sales staff - **Customer visits**: Observe competing products at customer locations - **Price inquiry**: Pose as a customer to request a quotationTechnical Analysis
The Skill recommends collecting competitor information through shared suppliers and customers and explicitly directs the operator to pose as a customer when requesting pricing. Impersonating a prospective customer is a deceptive social-engineering technique. Approaching business partners for undisclosed competitor information may also solicit confidential pricing, customer, production, or commercial data without authorization.
The issue does not match T01-T09 because the document does not hijack Agent instructions, execute code, escalate privileges, establish persistence, spoof tools, or introduce insecure dependencies. It instead creates a business, privacy, and compliance risk through deceptive intelligence-gathering instructions.
Attack Path
- An operator loads the Skill and selects a competitor for investigation.
- The operator identifies the competitor's customers or shared suppliers.
- The operator requests competitor information from those parties, potentially without confirming that disclosure is authorized.
- The operator poses as a prospective customer and requests quotations or commercial terms from the competitor.
- The collected pricing, customer, capacity, or operational information is consolidated into a competitor profile.
- The information may then be used fo ...[truncated 731 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to pose as a customer when requesting quotations.
- Restrict intelligence collection to lawful public sources or information obtained with explicit, documented authorization.
- Prohibit requests for trade secrets, confidential pricing, non-public customer lists, personal information, and information protected by contractual duties.
- Require source provenance, collection date, consent status, and confidentiality classification for every collected item.
- Add a mandatory legal and compliance review before using information obtained from customers, suppliers, employees, or other third parties.
- Establish retention, access-control, and deletion rules for customer and competitor intelligence.
- Replace deceptive inquiries with transparent market-research requests that accurately identify the requester and intended purpose.
- Require corroboration through reputable public sources before information is included in reports or alerts.