technology-search
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local subprocesses to manage searches and fallback logic.
- The
search_news.jsscript employschild_process.execFileto invokebashornodefor fallback search operations via a siblingweb-searchskill. - The
search-news.shandsearch-news.ps1entry points facilitate execution of the core Node.js logic. - [EXTERNAL_DOWNLOADS]: The skill fetches data from numerous external technology platforms and community forums.
- It communicates with reputable news sources including TechCrunch, The Verge, Wired, and Hacker News via RSS and API endpoints.
- The
network_detector.jsscript performs connectivity checks against well-known services like Cloudflare to determine the available network environment. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the processing of external news summaries.
- Ingestion points: External article titles and summaries are ingested through
scripts/parsers/rss_parser.jsandscripts/parsers/hn_parser.js. - Boundary markers: The output formatting instructions in
SKILL.mddo not implement explicit delimiters or safety warnings for the agent when interpreting external content. - Capability inventory: The skill possesses capabilities for subprocess execution via
execFile, network requests via thehttpsmodule, and file system writes for caching and temporary storage. - Sanitization: While
rss_parser.jsincludes basic HTML tag removal, it does not filter for semantic instructions or malicious prompts embedded within news summaries.
Audit Metadata