Brands struggle to measure how AI systems mention them and their competitors. BotSee manages research inputs, runs analyses, and turns results into actionable reports.
Review the Skillstore skill "botsee" from https://skillstore.io/skills/rivalsee-botsee.md and its manifest at https://skillstore.io/api/skills/rivalsee-botsee/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.
エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
The skill intentionally contacts the BotSee API, persists local state, and writes generated content. Most high-severity static matches are false positives caused by API-key identifiers, documented config paths, UUID handling, and Markdown backticks. Two medium issues remain: sensitive files are permissioned after creation, and secrets can be passed through command-line arguments.
Credential files created before restrictive permissions
Two credential-writing paths apply mode 0600 only after writing. On a permissive or preexisting BotSee directory, another local user could briefly read signup tokens or API keys.
Both functions visibly open and write sensitive files before calling chmod. The safer save_user_config path demonstrates that an umask can prevent this creation-time window.
API keys, signup tokens, reset tokens, and payment proofs can be supplied as command arguments. These values may remain in shell history or appear in process listings.
The argparse definitions and usage instructions explicitly place credential-like values after flags. Command arguments commonly persist outside the process receiving them.
This line writes the BotSee API key and account metadata to the user configuration file. The write is intentional and normally protected by a restrictive umask, but it persists sensitive data.
This line writes generation settings to .context/botsee-config.json in the current workspace. The data is not secret, but the command has a real workspace modification side effect.
This line writes pending signup metadata, including the setup token, to the user home directory. Permissions are tightened only after the write, which creates a brief exposure risk.
This line writes an API key to the user configuration file. The file is changed to mode 0600 afterward, but the credential can briefly inherit broader creation permissions.
This line creates a timestamped Markdown file in the current directory using content returned by the service. It is an intentional output write that can replace a same-named file.
This line constructs outbound BotSee API requests that can include request data and an authorization header. The network use is expected, but it is a real external data transfer.
with urllib.request.urlopen(req, timeout=timeout, context=ssl_context) as resp:
This line sends the prepared HTTPS request to the configured BotSee endpoint. Certificate and hostname verification remain enabled, so the network risk is limited and intentional.
The code reads BOTSEE_BASE_URL and uses it as the destination for later authenticated requests. This is intentional configuration, but an untrusted value could redirect API traffic.
rivalsee. (2026). botsee security audit report (audit version 1) [Author version 0.3.0]. Skillstore. https://skillstore.io/skills/rivalsee-botsee/audits/1
BibTeX形式の引用
@techreport{rivalsee-rivalsee-botsee-2026,
author = {rivalsee},
title = {botsee security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/rivalsee-botsee/audits/1},
note = {Author version 0.3.0}
}
CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "botsee security audit report (audit version 1)"
version: "0.3.0"
type: report
authors:
- name: "rivalsee"
date-released: "2026-09-14"
url: "https://skillstore.io/skills/rivalsee-botsee/audits/1"
identifiers:
- type: other
value: "skillstore:rivalsee-botsee:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由証拠の信頼度: 中
55
アーキテクチャ
100
保守性
87
コンテンツ
65
コミュニティ
96
仕様準拠
作成できるもの
Track brand visibility
Measure brand appearances, ranking, competitors, keywords, and cited sources across supported AI answer providers.
Build audience research
Create customer types, personas, and buyer questions before running a structured visibility analysis.
Automate competitive reporting
Run analyses, retrieve detailed results, inspect credit usage, and generate content from agent workflows.
これらのプロンプトを試す
Check account status
Check my BotSee account status, active site, remaining credits, and available next actions. Do not start any paid operation.
Set up a research site
Create a BotSee site for [DOMAIN] with [TYPE_COUNT] customer types, [PERSONA_COUNT] personas per type, and [QUESTION_COUNT] questions per persona.
Run and summarize analysis
Run a BotSee analysis for [SITE_UUID]. Summarize leading competitors, recurring keywords, cited sources, and remaining credits after completion.
Compare detailed findings
Analyze [SITE_UUID] using [MODELS] and [SCOPE]. Retrieve responses, competitors, keywords, sources, and recommendations, then identify three evidence-backed priorities.
ベストプラクティス
Check the active site and credit balance before starting analysis or generation.
Use explicit site and analysis identifiers when several projects are active.
Review generated content and recommendations before publishing or applying them.
回避
Do not place live API keys, reset tokens, or payment proofs in shared prompts or logs.
Do not retry create commands blindly because repeated calls can create duplicate resources.
Do not start paid analysis or generation without confirming the site, scope, and expected credit use.
よくある質問
What does this skill measure?
It uses BotSee to measure brand mentions, competitors, rankings, keywords, sources, and AI responses.
Which AI tools can use this skill?
The report declares support for Claude, Codex, and Claude Code.
Does the skill require a BotSee account?
Yes. Most operations require a BotSee API key, network access, and available credits.
Where are credentials stored?
The skill stores the API key and active site in ~/.botsee/config.json.
Does analysis finish immediately?
No. The command polls BotSee until completion and can wait for up to ten minutes.
Does the skill write project files?
Yes. It writes workspace configuration and saves generated blog content as a timestamped Markdown file.