public-relations
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions and shell commands to fetch data from well-known services including Google News, Hacker News (via the Algolia API), and Reddit. These operations are used for legitimate news monitoring and do not involve sensitive information.
- [COMMAND_EXECUTION]: In
references/newsjacking.md, the skill provides example shell commands usingcurlandjqto automate the collection of news data. These are standard developer tools and the commands are limited to data retrieval and processing. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it is designed to ingest and process untrusted external data from the web.
- Ingestion points: External news headlines and article content are retrieved via RSS feeds and APIs in
references/newsjacking.md. - Boundary markers: No specific delimiters or instructions to ignore embedded content are included in the data retrieval scripts.
- Capability inventory: The skill uses
curlfor network access and references thedev-browsertool for visiting journalist pages. - Sanitization: No explicit sanitization or validation of the external content is shown in the provided command-line examples.
Audit Metadata