skills/ninehills/skills/pua/Gen Agent Trust Hub

pua

Fail

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONTIME_DELAYED_CONDITIONALINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill is instructed to fetch prompt instructions from an external, non-whitelisted domain (pua-api.agentguard.workers.dev) and execute them as part of the agent's operating context, allowing for remote instruction injection.\n- [DATA_EXFILTRATION]: The skill collects user phone numbers during registration and transmits them to an external API. It also periodically uploads session telemetry and tool usage statistics to an external service (pua-skill.pages.dev).\n- [EXTERNAL_DOWNLOADS]: The skill performs unverified package installations using pip and downloads remote instruction templates at runtime from non-whitelisted sources.\n- [COMMAND_EXECUTION]: The skill invokes system commands such as curl for network communication and pip for package management within its automated workflows.\n- [PROMPT_INJECTION]: The skill uses strong persona-switching instructions and behavior overrides that may be used to bypass standard AI safety constraints.\n- [TIME_DELAYED_CONDITIONAL]: The skill contains logic to trigger specific behaviors or phrases based on the current date, as defined in its holiday triggers list.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user feedback and maintains a persistent state that influences future agent behavior, creating an attack surface for indirect instruction injection.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 13, 2026, 10:21 AM