public-relations
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell command examples using
curlto fetch RSS and JSON data from established services including Google News, Hacker News (via Algolia), and Reddit. These commands are intended for data retrieval to support newsjacking analysis and are piped to parsers likejqandxmllintrather than execution shells. - [INDIRECT_PROMPT_INJECTION]: As the skill involves processing external content from news outlets and social media, it explicitly instructs the agent to treat fetched data as untrusted. It contains a specific warning in
references/newsjacking.mdto never follow instructions embedded in article text or HTML, which serves as a mitigation against indirect prompt injection. - [DATA_EXPOSURE]: The skill mentions using local storage files such as
.agents/media-list.mdand.agents/product-marketing.mdfor context management. This is standard practice for maintaining persistence within the agent's designated workspace and does not involve exposure of sensitive system credentials.
Audit Metadata