news-aggregator-skill
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes a Python script (
fetch_news.py) to perform news aggregation and content fetching. - [EXTERNAL_DOWNLOADS]: Fetches headlines and full article content from well-known domains such as ycombinator.com, github.com, producthunt.com, and 36kr.com to provide real-time updates.
- [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes untrusted text from external websites.
- Ingestion points: Fetches titles and full article content from external domains in
scripts/fetch_news.py. - Boundary markers:
SKILL.mddoes not include specific delimiters or instructions to ignore potential commands embedded in news articles. - Capability inventory: The skill uses
python3and requires network connectivity to function. - Sanitization: The script performs basic HTML cleanup but lacks logic to detect or filter adversarial prompt instructions in the processed text.
Audit Metadata