reg-feed-watcher
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches regulatory data from official government and legal institutions such as the Federal Register, SEC, FTC, and the EDPB. All identified sources in the provided catalog are well-known, reputable organizations, and these operations are consistent with the skill's primary purpose.
- [COMMAND_EXECUTION]: The instructions suggest the use of 'pandoc' for file conversion. This is provided as a recommendation for the user to perform manually and is not executed automatically by the agent.
- [DATA_EXFILTRATION]: The skill reads configuration files from the agent's plugin directory and writes summary digests to the local file system (e.g., '~/regulatory-legal-digests/'). This behavior is functional for the intended use case and does not involve unauthorized data transmission to external endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data from regulatory feeds.
- Ingestion points: Data enters the context via RSS and API feeds listed in 'references/source-catalog.md' and the user's local 'CLAUDE.md' configuration.
- Boundary markers: No explicit delimiters are specified for wrapping external content in the digest output.
- Capability inventory: The skill has local file-write capabilities and provides instructions for document conversion via 'pandoc'.
- Sanitization: No specific sanitization or filtering logic is described for the content retrieved from external feeds. While this presents a surface for indirect injection, the risk is mitigated by the high-trust nature of the target government and institutional sources.
Audit Metadata