pp-foxnews
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the core CLI tool using
npx -y @mvanhorn/printing-press-library install foxnews --cli-only. This package is a vendor-owned resource used for the skill's primary functionality. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external Fox News RSS feeds (e.g.,
https://moxie.foxnews.com/google-publisher/latest.xml). - Ingestion points: Remote XML feeds containing headlines, links, and publication dates (SKILL.md).
- Boundary markers: The skill does not explicitly define delimiters or instructions to the agent to ignore embedded commands within the fetched data.
- Capability inventory: The skill uses the
Bashtool to executefoxnews-pp-cliandjqfor data processing (SKILL.md). - Sanitization: No sanitization, validation, or filtering of the external RSS content is documented before it is passed to the agent context.
Audit Metadata