news-express
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data from numerous RSS feeds, creating a surface for indirect prompt injection attacks.
- Ingestion points: The skill uses the
web_fetchtool to ingest content from external RSS URLs listed inSKILL.md(e.g., 36kr, TechCrunch, etc.). - Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the fetched content purely as data or to ignore any instructions potentially embedded within news titles or summaries.
- Capability inventory: While the skill itself focuses on text aggregation and formatting, it relies on the agent's
web_fetchtool. The risk depends on the broader capabilities of the agent context, which could be subverted if the agent follows malicious instructions found in a compromised RSS feed. - Sanitization: The instructions lack specific requirements for the agent to sanitize, filter, or validate the fetched XML content before extraction and output.
Audit Metadata