news-aggregator-skill
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate news aggregation tasks using standard protocols and libraries without malicious intent.\n- [EXTERNAL_DOWNLOADS]: Fetches data from well-known services including GitHub, Algolia (Hacker News API), and Hugging Face. These operations are essential to the skill's primary function and target established public endpoints.\n- [COMMAND_EXECUTION]: Executes a local Python script provided with the skill. The script uses built-in Python modules and does not perform any dangerous shell operations or external command execution.\n- [DATA_EXFILTRATION]: No sensitive local information is accessed. The skill writes the aggregated news data to a local reports directory in JSON format for the user's reference.\n- [PROMPT_INJECTION]: The skill provides an interface for ingesting external data from the web, which is an inherent surface for indirect prompt injection. However, the data is handled safely as structured JSON.\n
- Ingestion points: News titles and repository descriptions fetched from external web sources in scripts/news_aggregator_run.py.\n
- Boundary markers: Output is formatted as JSON, separating untrusted content from the agent's instructions.\n
- Capability inventory: The skill is restricted to network reads and local file writes within its own project directory; it lacks system-level privileges.\n
- Sanitization: Basic stripping of HTML tags from GitHub trending titles.
Audit Metadata