Skip to content
skillsafebeta
← Report library
Purpose / Other

Public Relations Skill Security Audit

What the author says it does (original text)

When the user wants help with public relations, earned media, press coverage, journalist outreach, or media strategy (not pull requests). Also use when the user mentions 'PR,' 'public relations,' 'press,' 'press release,' 'press coverage,' 'media outreach,' 'pitch a journalist,' 'get featured,' 'media list,' 'media kit,' 'press kit,' 'newsjacking,' 'news hijack,' 'HARO,' 'Qwoted,' 'Featured,' 'Hel

Independent security check

Do not install or run it yet

Files checked
8
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Substituting raw topic text into the example shell commands can enable command injection

Source references: 3
What we found

The tooling instructions tell the agent to replace QUERY or SUBREDDIT inside shell examples without requiring URL encoding, input validation, or safe argument passing. If replacement is textual, input containing quotes or shell operators can alter the command.

Why this matters

A malicious or accidentally crafted topic could run additional shell commands with the agent’s permissions, read accessible files, modify the workspace, or make unintended network requests.

What this evidence establishes

These are documentation examples, not a shown auto-executing script. The Google News example instructs partial encoding with `+` and `%22`; complete URL encoding would keep topic text from changing shell syntax. However, the document does not require complete encoding or safe argument passing, and SUBREDDIT is unvalidated, so naïve substitution of untrusted text could permit command injection. Users can prohibit shell-string interpolation, require a URL-encoding library and an allowlist, and inspect the final command before execution.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/newsjacking.md:149In the instructionsOpen original file
```bash# Replace QUERY with topic (use + for spaces, %22 for quotes)curl -s "https://news.google.com/rss/search?q=QUERY&hl=en-US&gl=US&ceid=US:en" \  | xmllint --xpath "//item[position()<11]" - 2>/dev/null```
Show 2 other places
references/newsjacking.md:157In the instructionsOpen original file
```bashSINCE=$(($(date +%s) - 86400))curl -s "https://hn.algolia.com/api/v1/search_by_date?query=QUERY&tags=story&numericFilters=created_at_i>${SINCE}" \  | jq '.hits[] | {title, url, points, num_comments, created_at, hn_url: ("https://news.ycombinator.com/item?id="+.objectID)}'```
references/newsjacking.md:165In the instructionsOpen original file
```bashcurl -s -A "newsjack/1.0" \  "https://www.reddit.com/r/SUBREDDIT/top.json?t=day&limit=15" \  | jq '.data.children[].data | {title, url, score, num_comments, created_utc}'```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

Pitch workflows may disclose internal data, customer identities, and contact details

Source references: 6
What we found

The Skill first reads internal product-marketing material, then asks pitches to include data, quotes, a customer name, and contact information, with templates offering raw datasets or customer introductions. It does not require field-by-field disclosure approval or customer consent.

Why this matters

If an agent directly uses project context, unpublished metrics, customer relationships, personal contact details, or raw data could be sent to journalists or press platforms, creating confidentiality, privacy, contractual, and reputational harm.

The skill first reads an internal product-marketing file, then recommends including data, customer names, contact details, raw datasets, and customer interview offers in pitches. These are legitimate PR materials, but the visible workflow does not verify disclosure authority or customer consent item by item. Drafting or sending could therefore expose confidential business or customer information. Users can require draft-only behavior and explicit approval for every disclosed dataset, identity, and contact detail.

SKILL.md:14In the instructionsOpen original file
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
Show 5 other places
SKILL.md:92In the instructionsOpen original file
- [ ] Does this journalist cover this beat? (Check their last 5 articles.)- [ ] Is there a clear news hook — something that just happened or is about to?- [ ] Could this journalist write a complete story from this email alone? (Data, quotes, customer name, contact.)- [ ] Is the subject line specific enough to predict the article's headline?- [ ] Is the pitch under 150 words?- [ ] Did you avoid the words "revolutionary," "game-changing," "disruptive," and "synergy"?- [ ] Is the ask clear? (Interview? Embargo? Exclusive? Quote?)
references/journalist-pitching.md:84In the instructionsOpen original file
We [analyzed N / surveyed N / tracked N] and found:• [Stat 1 with surprise factor]• [Stat 2]• [Stat 3]The most interesting pattern: [one-sentence insight].Full data + methodology here: [link to one-pager, not your homepage]Happy to share the raw dataset, jump on a call, or connect you with[customer who's relevant].
references/press-platforms.md:77In the instructionsOpen original file
[Specific credential — 1 sentence. "Built X for 5 years" / "Led marketing at Y" / "Have analyzed N companies in space"]The most important thing about [topic]: [your actual point in 2 sentences].[A specific example, story, or data point — this is what gets quoted.][If applicable: a contrarian or surprising angle that differentiates from typical answers.]Happy to expand on any of this, share data, or be quoted directly.Feel free to use this attribution:[Your name], [your title], [your company]Contact for follow-up: [email + phone]```
references/journalist-pitching.md:91In the instructionsOpen original file
Full data + methodology here: [link to one-pager, not your homepage]Happy to share the raw dataset, jump on a call, or connect you with[customer who's relevant].
references/journalist-pitching.md:158In the instructionsOpen original file
Customer details:• Name: [name, title, company]• Available: [windows]• Willing to share: [data points / screenshots / metrics]Happy to coordinate the intro.
Medium risk

Journalist profiles and emails are collected, guessed, and retained in the project

Source references: 4
What we found

The Skill collects journalists’ social activity, employment details, and email addresses, suggests guessing common email patterns and bounce-checking them, and stores the list in `.agents/media-list.md` or CSV. It defines no source restriction, retention period, access boundary, or deletion process.

Why this matters

This can create a contact database that persists through a repository or shared workspace. Guessing or verifying addresses may also disclose personal identifiers to services such as Hunter.io or RocketReach and create privacy, compliance, and misdirected-email risk.

This is legitimate targeted media research, but it aggregates journalists’ recent work, social activity, roles, and email addresses; it also suggests guessing addresses and bounce-checking them, then storing the list in the project. That collection may be exposed to project collaborators, while guessed addresses can reach the wrong person or be treated as unwanted outreach. Users can require publicly posted contact channels only, prohibit guessing/bounce checks, and set access, retention, and deletion limits.

references/journalist-pitching.md:25In the instructionsOpen original file
- [ ] Read their **last 5 articles** — are they covering your beat right now?- [ ] Note their **publication** — does it reach your ICP?- [ ] Check their **bio** on the outlet site — what topics do they own?- [ ] Check **X/LinkedIn** for what they're posting about this week- [ ] Note their **email** (usually on outlet author page, Muck Rack, or company About page)- [ ] Check **Muck Rack** if available — it shows recent topics and pitch preferences
Show 3 other places
references/journalist-pitching.md:319In the instructionsOpen original file
```bash# Most journalists' emails follow patterns:# firstname@outlet.com# firstname.lastname@outlet.com# flastname@outlet.com# Use Hunter.io, RocketReach, or just guess and bounce-check```
references/journalist-pitching.md:347In the instructionsOpen original file
### Maintaining the media listStore in `.agents/media-list.md` (or `.csv` if you prefer). Update monthly — journalists move jobs constantly.```markdown## Tier 1 (top 20)| Name | Outlet | Beat | Last contact | Last coverage | Email | Score ||------|--------|------|--------------|---------------|-------|-------|| ...  | ...    | ...  | 2026-05-15   | none yet      | ...   | 9/10  |```
references/journalist-pitching.md:329In the instructionsOpen original file
Use `dev-browser` (persistent session, no rate limits) to:- Open the journalist's outlet author page → scrape last 5 article headlines + dates- Open their X/Twitter profile → note recent topics- Open their LinkedIn → confirm current role
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

External web content can influence the agent through the research workflow

Source references: 4
What we found

The Skill directs the agent to open author pages, X, LinkedIn, Muck Rack, podcast sites, and search results, but does not say to treat page text as untrusted data or prohibit following instructions addressed to an AI within those pages.

Why this matters

A malicious or compromised profile, article, or show page could steer the agent away from research, expose previously read product context, prompt access to other files, or manipulate journalist scores and recommendations.

The skill explicitly has the agent ingest author pages, social profiles, search results, podcast sites, and sometimes full transcripts for analysis, without a visible rule treating instructions embedded in those pages as untrusted. A malicious or compromised page could therefore try to redirect agent behavior. This establishes an exposure, not proof that an attack occurred or that page text would be obeyed. Users can restrict extraction to titles, dates, and public biographies, forbid following page-supplied instructions, and separately approve external actions.

references/journalist-pitching.md:327In the instructionsOpen original file
### Researching their recent work (browser-driven)Use `dev-browser` (persistent session, no rate limits) to:- Open the journalist's outlet author page → scrape last 5 article headlines + dates- Open their X/Twitter profile → note recent topics- Open their LinkedIn → confirm current role
Show 3 other places
references/newsjacking.md:171In the instructionsOpen original file
### Journalist research (browser-driven)For finding *which* journalists are covering the story right now:- **dev-browser** → Google News search for the story → click through to articles → note the bylines- Then go to those journalists' X / LinkedIn / Muck Rack profile to confirm beat and recent coverage
references/podcast-guest-prep.md:21In the instructionsOpen original file
Work through sources in this order; each is a fallback for the last:1. **RSS feed first.** The richest source: full episode descriptions, chapter markers, guest links, dates. Find the feed link on the podcast site (Buzzsprout, Transistor, etc. all expose one). Large-feed fetches may truncate — check whether the oldest episodes you need actually made it.2. **The podcast website's episode list** for anything the feed missed. These pages often lazy-load older episodes via JavaScript; if pagination returns nothing, note the gap and move on rather than burning time.3. **Apple Podcasts show page** — reliably renders the latest ~8 episodes with full descriptions.4. **Web search** for stray episodes, the hosts, and the show's reputation.Don't fetch every episode page. Descriptions plus chapter lists are almost always enough; only pull a full transcript when a specific episode is central (e.g., a debate the guest should have a position on). Check for published transcript links in the feed.
references/newsjacking.md:173In the instructionsOpen original file
For finding *which* journalists are covering the story right now:- **dev-browser** → Google News search for the story → click through to articles → note the bylines- Then go to those journalists' X / LinkedIn / Muck Rack profile to confirm beat and recent coverage
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The newsjacking workflow may communicate externally without final approval

Source references: 6
What we found

The workflow treats pitching journalists and publishing to a blog, LinkedIn, and X as execution steps and stresses a short response window. It contains no explicit user-confirmation, account-selection, or final-content approval gate before those external actions.

Why this matters

With access to authenticated email or social accounts, an agent could publish unverified figures, sensitive positions, or off-brand language, leading to public corrections, damaged media relationships, or brand controversy.

What this evidence establishes

The newsjacking document lists “Pitch” and “Post” as workflow steps under tight timing; “Post” could be read as an instruction to publish externally. However, the pitch step explicitly says to draft, the main workflow also asks only for a draft, and no sending or account-control implementation is shown. Automatic publication is therefore not established, but the authorization boundary is ambiguous. Users can restrict it to research and drafts and require separate approval of the account and final content before any external action.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/newsjacking.md:37In the instructionsOpen original file
1. **Detect** — surface trending stories in your category (see [Sources & Tooling](#sources--tooling))2. **Score** — apply the [newsworthiness rubric](#newsworthiness-scoring-rubric); drop anything below threshold3. **Angle** — generate 2–3 angles per story using the [angle library](#story-angle-library)4. **Validate** — sanity-check: do you actually have the expertise/data to back this angle?5. **Pitch** — draft a tight pitch to 3–5 journalists who cover this beat (see [journalist-pitching.md](journalist-pitching.md))6. **Post** — also publish on your blog, LinkedIn, X — it builds the trail journalists check before quoting you
Show 5 other places
references/newsjacking.md:127In the instructionsOpen original file
## Speed: The Only Thing That MattersNewsjacking decays fast. Approximate windows:| Story type | Effective window ||-----------|------------------|| Breaking tech news | 4–12 hours || Major regulation / policy | 24–48 hours || Industry report / data drop | 24–72 hours || Conference announcement | Same day || Acquisition / funding news | 12–24 hours |**Implication:** if you can't draft and send within the window, don't bother. Set up the loop so detection → pitch takes <2 hours.
references/newsjacking.md:212In the instructionsOpen original file
Every newsjack pitch is stronger if the journalist can find evidence you've been thinking about this publicly. Before pitching:1. Publish a short post (blog, LinkedIn, X thread) with your take2. Reference it in the pitch ("more thinking here: [link]")3. This signals you're not opportunistic — you're an actual voice in the space
references/newsjacking.md:35In the instructionsOpen original file
A repeatable workflow Claude can run on demand or daily.1. **Detect** — surface trending stories in your category (see [Sources & Tooling](#sources--tooling))2. **Score** — apply the [newsworthiness rubric](#newsworthiness-scoring-rubric); drop anything below threshold3. **Angle** — generate 2–3 angles per story using the [angle library](#story-angle-library)4. **Validate** — sanity-check: do you actually have the expertise/data to back this angle?5. **Pitch** — draft a tight pitch to 3–5 journalists who cover this beat (see [journalist-pitching.md](journalist-pitching.md))6. **Post** — also publish on your blog, LinkedIn, X — it builds the trail journalists check before quoting you
references/newsjacking.md:139In the instructionsOpen original file
**Implication:** if you can't draft and send within the window, don't bother. Set up the loop so detection → pitch takes <2 hours.
SKILL.md:123In the instructionsOpen original file
### "Help me newsjack [trending story]"Go to [newsjacking.md](references/newsjacking.md), run the scoring rubric, draft 2–3 angles, pick the best, draft the pitch.

Inside this skill

7 instruction sections

The Skill supports earned-media strategy for software products, including newsjacking, journalist lists, pitches, press-request responses, and podcast preparation.

View source
SKILL.md:8In the instructionsOpen original file
# Public Relations & Earned MediaYou are an expert in earned media for software products. Your goal is to help the user get covered by journalists, podcasts, and newsletters — efficiently, with respect for the people on the other end of the pitch.

Before working, it reads a project product-marketing document. Podcast preparation also collects the guest’s history, quantified stories, and contrarian opinions, and offers to save them back into that document.

View source
SKILL.md:14In the instructionsOpen original file
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
references/podcast-guest-prep.md:9In the instructionsOpen original file
Read `.agents/product-marketing.md` (or `.claude/product-marketing.md`) for the company, positioning, and ICP. That file usually won't have the guest's *story bank*, so also collect — in one batch, not a drip:1. What did you build before this that comes up in conversation?2. What are 2–3 stories you tell well, with real numbers attached?3. What's one opinion you hold that most people in your space disagree with?Offer to save the answers into the product-marketing context doc so future runs skip the interview.

Journalist research visits outlet author pages, X, LinkedIn, and Muck Rack, collects recent topics, employment information, and email addresses, and recommends retaining the contact list in a project file.

View source
references/journalist-pitching.md:25In the instructionsOpen original file
- [ ] Read their **last 5 articles** — are they covering your beat right now?- [ ] Note their **publication** — does it reach your ICP?- [ ] Check their **bio** on the outlet site — what topics do they own?- [ ] Check **X/LinkedIn** for what they're posting about this week- [ ] Note their **email** (usually on outlet author page, Muck Rack, or company About page)- [ ] Check **Muck Rack** if available — it shows recent topics and pitch preferences
references/journalist-pitching.md:347In the instructionsOpen original file
### Maintaining the media listStore in `.agents/media-list.md` (or `.csv` if you prefer). Update monthly — journalists move jobs constantly.

News monitoring uses curl requests to Google News, Hacker News, and Reddit and calls for installing jq; using this workflow therefore makes outbound requests, while the installation step changes the local software environment.

View source
references/newsjacking.md:143In the instructionsOpen original file
## Sources & ToolingReuses tooling from the `social` skill's listening workflow. Same install: `brew install jq`.### Google News RSS (no auth)```bash# Replace QUERY with topic (use + for spaces, %22 for quotes)curl -s "https://news.google.com/rss/search?q=QUERY&hl=en-US&gl=US&ceid=US:en" \  | xmllint --xpath "//item[position()<11]" - 2>/dev/null
references/newsjacking.md:155In the instructionsOpen original file
### Hacker News (Algolia) for tech stories```bashSINCE=$(($(date +%s) - 86400))curl -s "https://hn.algolia.com/api/v1/search_by_date?query=QUERY&tags=story&numericFilters=created_at_i>${SINCE}" \  | jq '.hits[] | {title, url, points, num_comments, created_at, hn_url: ("https://news.ycombinator.com/item?id="+.objectID)}'```### Reddit (for category-specific subs)```bashcurl -s -A "newsjack/1.0" \  "https://www.reddit.com/r/SUBREDDIT/top.json?t=day&limit=15" \  | jq '.data.children[].data | {title, url, score, num_comments, created_utc}'```
Start here · InstructionsSKILL.md
public-relations
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 12
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records8 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/journalist-pitching.mdFull text included
  • references/media-outlets.mdFull text included
  • references/newsjacking.mdFull text included
  • references/podcast-guest-prep.mdFull text included
  • references/press-platforms.mdFull text included
  • references/story-angles.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/journalist-pitching.mdSupporting file
  • references/media-outlets.mdSupporting file
  • references/newsjacking.mdSupporting file
  • references/podcast-guest-prep.mdSupporting file
  • references/press-platforms.mdSupporting file
  • references/story-angles.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:3In the instructionsOpen original file
name: public-relationsdescription: "When the user wants help with public relations, earned media, press coverage, journalist outreach, or media strategy (not pull requests). Also use when the user mentions 'PR,' 'public relations,' 'press,' 'press release,' 'press coverage,' 'media outreach,' 'pitch a journalist,' 'get featured,' 'media list,' 'media kit,' 'press kit,' 'newsjacking,' 'news hijack,' 'HARO,' 'Qwoted,' 'Featured,' 'Help A Reporter,' 'reporter request,' 'tech press,' 'TechCrunch,' 'earned media,' 'thought leadership placement,' 'op-ed,' 'guest article,' 'press contacts,' 'podcast prep,' 'going on a podcast,' 'podcast guest,' 'prep me for this podcast,' or 'how do I get press.' Use this for earned media work — finding journalists, pitching stories, newsjacking, prepping podcast appearances, and responding to press requests. For startup/SaaS/AI directory submissions, see directory-submissions. For product launches, see launch. For social-media engagement, see social. For cold-email outreach to prospects, see cold-email."metadata:
references/newsjacking.md:151In the instructionsOpen original file
# Replace QUERY with topic (use + for spaces, %22 for quotes)curl -s "https://news.google.com/rss/search?q=QUERY&hl=en-US&gl=US&ceid=US:en" \  | xmllint --xpath "//item[position()<11]" - 2>/dev/null
references/newsjacking.md:159In the instructionsOpen original file
SINCE=$(($(date +%s) - 86400))curl -s "https://hn.algolia.com/api/v1/search_by_date?query=QUERY&tags=story&numericFilters=created_at_i>${SINCE}" \  | jq '.hits[] | {title, url, points, num_comments, created_at, hn_url: ("https://news.ycombinator.com/item?id="+.objectID)}'
Read files
SKILL.md:139In the instructionsOpen original file
### "I'm going on [podcast] next week — help me prep"Go to [podcast-guest-prep.md](references/podcast-guest-prep.md): research the show (RSS feed → site → Apple Podcasts → web), extract the recurring threads and host profiles, map the guest's stories onto them, deliver the brief.
Run commands
references/journalist-pitching.md:319In the instructionsOpen original file
```bash# Most journalists' emails follow patterns:
references/newsjacking.md:149In the instructionsOpen original file
```bash# Replace QUERY with topic (use + for spaces, %22 for quotes)
references/newsjacking.md:157In the instructionsOpen original file
```bashSINCE=$(($(date +%s) - 86400))
Install extra software packages
references/newsjacking.md:145In the instructionsOpen original file
Reuses tooling from the `social` skill's listening workflow. Same install: `brew install jq`.
Lines read
1,299
File checksum (to compare versions)
385894969a2f09811583d97288a8dddf3e9f9af2bd78daf7d61d3f8326ca4c34