public-relations
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
curl,jq, andxmllintwithin thereferences/newsjacking.mdfile to fetch and parse data from public news feeds. These commands are used strictly for information gathering and data formatting. - [EXTERNAL_DOWNLOADS]: Fetches data from well-known services including Google News, Hacker News (via Algolia), and Reddit. These network operations are intended for monitoring trending topics as part of the public relations workflow.
- [EXTERNAL_DOWNLOADS]: Includes a recommendation to install
jqusing the Homebrew package manager, which is a standard utility for processing JSON data. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize untrusted data from external RSS feeds and community platforms. While this creates a theoretical surface for indirect prompt injection, it is a core requirement of the news monitoring functionality and does not involve unsafe interpolation into high-privilege commands.
- [SAFE]: The skill encourages best practices for PR, such as avoiding spam, respecting journalist preferences, and focusing on data-driven storytelling.
Audit Metadata