The Agent Skills Directory

[SAFE]: The skill consists of informational guides and templates designed for legitimate public relations tasks. No malicious patterns such as data exfiltration, obfuscation, or persistence were found.
[DATA_EXPOSURE]: The skill instructs the agent to read marketing context from internal files like .agents/product-marketing.md. This is a documented and standard practice for project-specific context management and does not constitute unauthorized data access.
[COMMAND_EXECUTION]: The skill provides utility commands using curl, jq, and xmllint in references/newsjacking.md to fetch news items from Google News, Hacker News, and Reddit. These commands target well-known public APIs for information gathering, which is consistent with the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]: The skill identifies trending stories from external news sources to draft PR pitches, creating a surface for indirect prompt injection.
Ingestion points: references/newsjacking.md fetches content from Google News RSS, Algolia (Hacker News), and Reddit APIs.
Boundary markers: Absent; the fetched data is processed directly to generate pitch angles.
Capability inventory: Use of curl, dev-browser, and file system writes to .agents/media-list.md.
Sanitization: No explicit sanitization or filtering of external news content is specified.

public-relations