public-relations

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes shell command examples using curl to fetch RSS and JSON data from established services including Google News, Hacker News (via Algolia), and Reddit. These commands are intended for data retrieval to support newsjacking analysis and are piped to parsers like jq and xmllint rather than execution shells.
  • [INDIRECT_PROMPT_INJECTION]: As the skill involves processing external content from news outlets and social media, it explicitly instructs the agent to treat fetched data as untrusted. It contains a specific warning in references/newsjacking.md to never follow instructions embedded in article text or HTML, which serves as a mitigation against indirect prompt injection.
  • [DATA_EXPOSURE]: The skill mentions using local storage files such as .agents/media-list.md and .agents/product-marketing.md for context management. This is standard practice for maintaining persistence within the agent's designated workspace and does not involve exposure of sensitive system credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 02:17 PM