newsletter-sponsorship-finder
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
requestslibrary viapip3 install requests, which is a standard Python library for making HTTP requests. The helper scriptscripts/search_newsletters.pyuses this library to query the Substack API. - [COMMAND_EXECUTION]: The instructions involve executing a local helper script
scripts/search_newsletters.pyviapython3. This script is part of the skill package and its behavior is limited to searching the Substack directory (https://substack.com/api/v1/publication/search) for keywords provided by the user. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external websites (newsletter directories, competitor sites, and Substack). While this presents a surface for indirect prompt injection, the risk is mitigated as the skill primarily extracts structured data (name, author, subscriber count) for a markdown report, rather than executing the content of the pages it visits.
Audit Metadata