public-trend-radar
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of local Node.js scripts (
packages/research-cli/dist/src/cli.js,scripts/bootstrap-runtime.mjs,scripts/doctor.mjs) and a CLI utility (subscription-research) to perform its core functions. - [EXTERNAL_DOWNLOADS]: Fetches trend data from established public platforms including GitHub, Hacker News, Hugging Face, and arXiv.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes content from untrusted public channels (e.g., community discussions, repository signals).
- Ingestion points:
trend fetch-publiccommand retrieves data from Hacker News, GitHub, Hugging Face, and arXiv (SKILL.md). - Boundary markers: The instructions do not define delimiters or specific 'ignore' instructions for the data being fetched.
- Capability inventory: The skill can execute local scripts and write output to the workspace (SKILL.md).
- Sanitization: No explicit sanitization or validation of the fetched external data is mentioned.
Audit Metadata