pulse
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches research data from well-known services including Hacker News (via Algolia API), Reddit, and GitHub. These operations align with the skill's primary research purpose.
- [COMMAND_EXECUTION]: Utilizes the system
datecommand to calculate Unix timestamps for search queries and to format dates for output filenames. - [PROMPT_INJECTION]: The skill processes untrusted content from web searches and social media which introduces a surface for indirect prompt injection.
- Ingestion points: External data is ingested through
WebSearch,WebFetch, and GitHub/Reddit/Algolia API responses inSKILL.md. - Boundary markers: None explicitly defined in instructions to isolate or delimit third-party snippets from system instructions.
- Capability inventory: The skill can execute shell commands (
date) and perform file writes to the local./out/pulse/directory. - Sanitization: HTML output is restricted to inline CSS with no JavaScript or external requests allowed, which serves to mitigate potential malicious content embedded in the sourced data.
Audit Metadata