reg-feed-watcher

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches regulatory data from official government and legal institutions such as the Federal Register, SEC, FTC, and the EDPB. All identified sources in the provided catalog are well-known, reputable organizations, and these operations are consistent with the skill's primary purpose.
  • [COMMAND_EXECUTION]: The instructions suggest the use of 'pandoc' for file conversion. This is provided as a recommendation for the user to perform manually and is not executed automatically by the agent.
  • [DATA_EXFILTRATION]: The skill reads configuration files from the agent's plugin directory and writes summary digests to the local file system (e.g., '~/regulatory-legal-digests/'). This behavior is functional for the intended use case and does not involve unauthorized data transmission to external endpoints.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data from regulatory feeds.
  • Ingestion points: Data enters the context via RSS and API feeds listed in 'references/source-catalog.md' and the user's local 'CLAUDE.md' configuration.
  • Boundary markers: No explicit delimiters are specified for wrapping external content in the digest output.
  • Capability inventory: The skill has local file-write capabilities and provides instructions for document conversion via 'pandoc'.
  • Sanitization: No specific sanitization or filtering logic is described for the content retrieved from external feeds. While this presents a surface for indirect injection, the risk is mitigated by the high-trust nature of the target government and institutional sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 03:58 PM
Security Audit — agent-trust-hub — reg-feed-watcher