hackernews
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a read-only interface to public data from the official HackerNews API. It does not require credentials, handle sensitive local files, or perform any unauthorized network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated content from HackerNews. Ingestion points: Data is fetched from the official HackerNews API via the get_stories, get_item, and get_comments tools. Boundary markers: The CLI strips HTML tags before display, though the MCP server provides raw text. Capability inventory: The skill is limited to network reads from the HackerNews API and local display/output; it does not have file-write or arbitrary command execution capabilities. Sanitization: HTML entities and tags are stripped in the CLI interface for display purposes.
Audit Metadata