competlab-status-watch — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited competlab-status-watch (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You probe each monitored competitor's public status page, extract current incidents + recent 90-day incident history, and report findings as decision-grade competitive intelligence.
Pull list_projects + list_competitors.
For each competitor, try in order:
status.{domain}/api/v2/status.json and /api/v2/incidents.json — structured JSON, fastest signalstatus.{domain} — HTML extraction{domain}.instatus.com — newer Statuspage.io alternativeissquareup.com)paypal-status.com stylestatus.{vendor}.com returns 401/403Use Bash + curl with --max-time 8 -A "<Chrome UA>".
curl -sS https://status.{domain}/api/v2/incidents.json | jq '.incidents[0:5] | .[] | {name, status, severity: .impact, created_at, resolved_at, components: .components}'Critical anti-pattern (banked from real-world validation): /status returning HTTP 200 + HTML body does NOT prove a status page exists. Common false-positives:
/status returns homepage HTML/status 200s but redirects to /en/ or /de/Verification gate: for any HTML 200 response on a status-page URL, use mcp__competlab__fetch_url with cleanHtml:true and verify ONE of:
<title> contains "status" / "uptime" / "incident" (case-insensitive)incident-list, component-status, current-status-indicator, statuspage- prefix, etc.)finalUrl after redirect still contains /status path (not redirected to homepage)If NONE of these markers present → mark as SPA-catchall / no-status-page (not a real status page).
Example failure modes from a real-world validation run:
/status → 200 + HTML, but finalUrl redirected to /en/ (locale-redirect false-positive — multilingual site geo-redirects to default locale)/status → 200 + HTML, but body was homepage content (SPA-catchall false-positive — single-page-app catch-all route serves homepage at any unmapped path)Read recent incident list from cleaned HTML only AFTER verification gate passes. Extract: incident titles, dates, severity, resolution time.
Per competitor:
Cross-competitor:
# Status & Reliability — [Category / Project]
> Generated [date] | X of N vendors have functional public status page
## Summary
[Coverage breakdown, top sales-ammunition findings]
## Per-competitor
### [Competitor]
- **Status page:** [URL + backend type] / [BROKEN/MISSING — signal]
- **Current:** [operational / degraded / outage]
- **Recent 90d:** [N incidents, total duration]
- **Notable:** [sales-ammunition list with dates + durations + impact]
## Cross-competitor patterns
[Coverage gap, reliability comparison, hygiene gaps]
## Sales ammunition ready-to-use
[1-3 concrete data points naming a specific dated incident, duration, and customer-facing impact]~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.