Competitor Teardown

The skill explicitly allows the `infsh/python-executor` tool, which can execute arbitrary Python code. This grants the agent (and potentially an attacker via prompt injection) the ability to run any Python script within the execution environment, leading to potential system compromise if not properly sandboxed.

allowed-tools: Bash(infsh *)
infsh app run infsh/python-executor --input '{ "code": "..." }'

The skill uses various `infsh` tools (`search-assistant`, `agent-browser`, `extract`) where input parameters like `query` and `url` are derived from user input. If these tools or the `infsh` wrapper do not properly sanitize inputs, an attacker could inject malicious commands or trigger Server-Side Request Forgery (SSRF) to access internal resources.

infsh app run tavily/search-assistant --input '{ "query": "..." }'
infsh app run infsh/agent-browser --input '{ "url": "..." }'

The `infsh/python-executor` and `infsh/stitch-images` tools are capable of writing files to the agent's local filesystem (e.g., `.png` images). This capability, if combined with arbitrary code execution or path traversal vulnerabilities, could be used for data exfiltration or to establish persistence.

plt.savefig("positioning-map.png", dpi=150)
infsh app run infsh/stitch-images --input '{ "images": [...] }'