cctv-news-fetcher
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill fetches news highlights from official CCTV domains (cctv.cntv.cn and tv.cctv.com) using a local crawling script.
- [SAFE]: The skill uses node-html-parser, a standard and well-known library for processing HTML content.
- [SAFE]: A hardcoded cookie (cna) is present in scripts/news_crawler.js. This is a common tracking cookie for the target website and does not contain sensitive user credentials or private access tokens.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external content from news articles to summarize for the user, which presents a surface for indirect prompt injection. However, since the source is a reputable news organization, the risk is minimal.
- Ingestion points: scripts/news_crawler.js fetches text from external news URLs.
- Boundary markers: No explicit delimiters are used when passing fetched news to the agent for summarization.
- Capability inventory: The skill executes a local script and performs network requests to fetch data.
- Sanitization: The crawler script performs basic text cleanup (removing newlines) but does not escape content against prompt injection.
Audit Metadata