directory-submissions
Fail
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The resource references/directory-list.md and the submission tracker template include the URL https://fitprofessionals.net. This URL is flagged as malicious and blacklisted by automated security scanners. Recommending the agent or user interact with known malicious domains presents a risk of malware delivery or credential theft.- [PROMPT_INJECTION]: The skill instructions in SKILL.md create a surface for indirect prompt injection by directing the agent to read marketing context from local files. * Ingestion points: The agent is instructed to read .agents/product-marketing.md, .claude/product-marketing.md, or product-marketing-context.md. * Boundary markers: The skill lacks explicit boundary markers or instructions to disregard potential malicious directives within these ingested files. * Capability inventory: The skill is primarily instructional but recommends shell command execution for verification. * Sanitization: No sanitization or validation is applied to the ingested context data.- [COMMAND_EXECUTION]: SKILL.md and the tracker template suggest the use of shell commands such as 'curl -sIL' to verify backlink status. If executed against the included malicious domain, this could be used to probe the environment or interact with a harmful endpoint.- [NO_CODE]: The skill consists entirely of markdown instructions and reference data files (CSV, JSON) without any associated executable scripts or binary files.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata