ai-release-hunter
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources, creating an attack surface where malicious instructions could be ingested.
- Ingestion points: Fetches data from api.github.com, news.ycombinator.com, claude.dev, and vercel.com/labs using the WebFetch tool.
- Boundary markers: The instructions lack specific delimiters or warnings to ignore embedded instructions when the agent parses and summarizes the external content.
- Capability inventory: The agent has Bash, Write, and Read capabilities, and is instructed to execute a shell command to send the final email digest.
- Sanitization: There is no mention of sanitizing or escaping the content retrieved from external sources before it is processed or included in the email body.
- [COMMAND_EXECUTION]: The skill relies on a user-provided shell command to send the digest, which is constructed using dynamic input.
- Evidence: The configuration requires a SEND_COMMAND and provides an example: --to "$RECIPIENT_EMAIL" --subject "$EMAIL_SUBJECT" --body "$(cat ...)".
- While the command itself is defined by the user, the agent executes it with arguments (like the email body) derived from untrusted external content, potentially leading to command injection if the shell interprets metacharacters in the body file.
- [EXTERNAL_DOWNLOADS]: The skill fetches data from several well-known external services as part of its core functionality.
- Fetches repository updates and release metadata from the official GitHub organizations of Anthropic, Meta, Vercel, OpenAI, and Google.
- Retrieves the latest trending stories from Hacker News via the Algolia API.
- Monitors technical updates and experimentation logs from the Claude dev blog and Vercel Labs experimental pages.
Audit Metadata