rss-fetch
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data from well-known news and technology services, including Hacker News (hnrss.org), TechCrunch, GitHub, Reddit, and Ars Technica. These are established public RSS feed providers and represent standard usage for content aggregation.- [COMMAND_EXECUTION]: The instructions leverage common system utilities such as
curl,xmllint,grep,awk,tr, andheadfor fetching and extracting text from XML data. All command usage is appropriate for the stated purpose of parsing RSS feeds.- [REMOTE_CODE_EXECUTION]: An automated alert suggested a remote code execution risk involving the download of an XML file to a temporary directory. Review of the code confirms that the file is only processed byxmllintfor data extraction and is never executed as a script or binary. The alert is a false positive.- [DATA_EXFILTRATION]: While the skill uses network operations, it does not access or transmit sensitive files (such as credentials or environment variables). The network activity is limited to fetching public information from reputable domains.
Audit Metadata