beehiiv-newsletter-report
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill interacts exclusively with the official Beehiiv API (
api.beehiiv.com), a well-known service. It includes explicit instructions to manage credentials securely using environment variables and registry pointers rather than storing sensitive tokens in configuration files. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where untrusted data (subscriber information and poll responses) is ingested and subsequently processed by an LLM to generate narratives. While this represents a potential injection surface, the skill mitigates this by restricting the LLM's scope to narrative generation based on deterministic numbers and recommending a validation step ('content-policy lint') to check generated content before publication.
- [COMMAND_EXECUTION]: The automation pipeline involves standard development workflows such as git operations (pull, commit, push) and scheduled task execution. These operations are intended for internal report management and do not involve executing arbitrary commands from untrusted remote sources.
Audit Metadata