public-relations

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands like curl, jq, and xmllint within the references/newsjacking.md file to fetch and parse data from public news feeds. These commands are used strictly for information gathering and data formatting.
  • [EXTERNAL_DOWNLOADS]: Fetches data from well-known services including Google News, Hacker News (via Algolia), and Reddit. These network operations are intended for monitoring trending topics as part of the public relations workflow.
  • [EXTERNAL_DOWNLOADS]: Includes a recommendation to install jq using the Homebrew package manager, which is a standard utility for processing JSON data.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize untrusted data from external RSS feeds and community platforms. While this creates a theoretical surface for indirect prompt injection, it is a core requirement of the news monitoring functionality and does not involve unsafe interpolation into high-privilege commands.
  • [SAFE]: The skill encourages best practices for PR, such as avoiding spam, respecting journalist preferences, and focusing on data-driven storytelling.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 11:29 PM