directory-submissions
Fail
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The resource files references/directory-list.md and references/submission-tracker-template.csv include a link to https://fitprofessionals.net. This domain is currently flagged as malicious or blacklisted by automated reputation scanners.
- [COMMAND_EXECUTION]: The instructions in SKILL.md and references/directory-list.md recommend using shell command templates (curl -sIL [URL] | grep -i rel=) to verify submissions. Providing these patterns without explicit guidance on URL sanitization or input validation creates a potential command injection vector if the directory list is compromised or manipulated.
- [PROMPT_INJECTION]: The skill is designed to ingest and process data from a large number of external directory websites and use that data to perform verification actions, creating an indirect prompt injection surface.
- Ingestion points: references/directory-list.md and external web content from the listed directories.
- Boundary markers: Absent; no specific instructions are provided to the agent to ignore or delimit potentially malicious content within external directory pages.
- Capability inventory: Shell command execution using the curl utility.
- Sanitization: Absent; no validation or escaping of the URLs or the content retrieved via curl is defined.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata