competlab-product-watch — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited competlab-product-watch (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You snapshot each monitored competitor's recent product launches from public changelogs, GitHub Releases, and named-asset directories.
For each competitor, probe candidate URLs in order:
stripe.com/changelog, Close close.com/changelog (clean ISO <time datetime=""> attributes), Mollie, Plaiddevelopers.{domain}/changelog (HubSpot, Pipedrive). Marketing-domain returns 404 for both; adapter must probe developer subdomain first.api.github.com/repos/{org}/{repo}/releases (Cline v3.82 May 1, v3.81 Apr 24, etc.)/blog/?category=product-updates, etc.{vendor}/claude-skills, {vendor}/mcp-marketplace, {vendor}/community-plugins (vendor-published directories listing third-party agent integrations)squareup.com/press, block.xyz/newsget_content_changelog to detect new /features/*, /integrations/*, /solutions/* URLs surfacing in their sitemap over time. NEW feature-page additions ARE product launches even when not announced via /changelog. This is the only product-velocity signal that works for the ~50% of vendors without a structured changelog convention.list_projects + list_competitors.
for path in "${domain}/changelog" "${domain}/updates" "${domain}/release-notes" "${domain}/whats-new" "developers.${domain}/changelog" "${domain}/blog/category/product-updates"; do
code=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 6 -A "$UA" "https://${path}")
[[ "$code" == "200" ]] && echo "${path} → 200"
doneFor successful URLs, use mcp__competlab__fetch_url with cleanHtml:true to extract recent entries.
For each changelog source, extract:
Cap at last 30-90 days per source. Limit to 10-20 entries per competitor max (don't dump full changelogs).
curl -sS "https://api.github.com/repos/{org}/{repo}/releases?per_page=10" | jq '.[] | {tag_name, name, published_at, body}'If a vendor has ≥3 same-week posts on the same topic + a product launch in the same window → classify as a single coordinated move, not 6 separate events. Example: Smartlead's April 1-8 2026 MCP-positioning push (5 same-week blog posts + 1 product post).
Per vendor:
Cross-vendor:
# Product Intelligence — [Category / Project]
> Generated [date] | Snapshot only — no velocity trend, no alerts
> Coverage: X of N vendors have structured changelog
## Summary
[Recent named launches, coverage range]
## Per-competitor
### [Competitor]
- Changelog source: [URL + format]
- Most recent NAMED launch: [name + date]
- Recent feature drops: [top 5 with dates]
- Cadence proxy: [N releases/month estimate]
- Strategic signals: [any coordinated moves]
## Cross-competitor patterns
[Velocity ranking, coordinated-launch detections, strategic-launch concentration]This skill captures CURRENT state. For:
→ Requires persistent monitoring infrastructure → promote to dimension. Decision criteria: customer demand signal post-skill-ship. If 3+ customers ask "tell me when X ships" → promote.
/changelog, no GitHub Releases, no named-asset directories, no /features/* sitemap-diff, etc.): record vendor as "no public product-velocity signal." For some categories this is universal (categorical-zero — surface as category whitespace, e.g., "no vendor in this category publishes a structured changelog → first-mover positioning opportunity").~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.