social-pulse-monitor
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external social platforms and news sources.
- Ingestion points: External mentions are fetched via
hn.py,bluesky.py,fediverse.py,discourse.py,gdelt.py, andtavily.py. It also processes user-provided social media exports. - Boundary markers: The skill contains explicit instructions to treat all fetched content as untrusted input per the project's security guidelines.
- Capability inventory: The skill writes reports to
memory/social/and submits mention events tomemory/events/channels.ndjsonvia a local script (registry-events.py). - Sanitization: There are explicit constraints stating that text inside a mention can never reclassify itself, suppress crisis flags, or modify the query set.
- [EXTERNAL_DOWNLOADS]: The skill connects to various external search and social media services to perform its primary function.
- Fetches data from Algolia (HN Search), Bluesky, GDELT (global news), and Tavily (web search).
- These operations are scoped to the skill's purpose of brand monitoring.
- [COMMAND_EXECUTION]: The skill interacts with local python scripts to perform network operations and record events.
- Executes connector scripts in
scripts/connectors/to interface with external APIs. - Invokes
registry-events.pyusing anoperation: proposerequest to update the channel registry.
Audit Metadata