everyfeed

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides documentation for using the everyfeed CLI for terminal-based workflows, including authentication, post management, and media uploads. The instructions mandate a strict confirmation-first policy, requiring explicit user approval for every command and prohibiting the use of automatic flags like --yes without prior verification of the exact payload.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the everyfeed package via npm install -g everyfeed. This package is a primary vendor-provided resource for the EveryFeed service. Additionally, the skill includes tools for importing media from external URLs (uploadMediaFromUrl), with built-in guidelines to show the target URL to the user and note that the platform performs safety checks against private network targets.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: Instructions include handling provider-specific credentials.json files for custom connections. The skill follows safe practice by explicitly instructing the agent never to display, summarize, or retain the content of these files, and to handle authentication through secure interactive prompts rather than chat-based token exchange.
  • [INDIRECT_PROMPT_INJECTION]: The skill manages content generation and ingestion from external sources (such as media URLs and provider rules). It mitigates risks by requiring all generated content to be treated as editable drafts and mandating the use of the validateComposerDraft tool to check all payloads for errors and compliance before they are proposed for publication.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 05:44 PM
Security Audit — agent-trust-hub — everyfeed