public-relations

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes instructions and shell commands to fetch data from well-known services including Google News, Hacker News (via the Algolia API), and Reddit. These operations are used for legitimate news monitoring and do not involve sensitive information.
  • [COMMAND_EXECUTION]: In references/newsjacking.md, the skill provides example shell commands using curl and jq to automate the collection of news data. These are standard developer tools and the commands are limited to data retrieval and processing.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it is designed to ingest and process untrusted external data from the web.
  • Ingestion points: External news headlines and article content are retrieved via RSS feeds and APIs in references/newsjacking.md.
  • Boundary markers: No specific delimiters or instructions to ignore embedded content are included in the data retrieval scripts.
  • Capability inventory: The skill uses curl for network access and references the dev-browser tool for visiting journalist pages.
  • Sanitization: No explicit sanitization or validation of the external content is shown in the provided command-line examples.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 02:37 AM