directory-submissions
Fail
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a reference to an external URL that has been flagged as a phishing site by security scanners. The URL 'https://aiagentsverse.com/submit' is listed in 'references/directory-list.md' and 'references/submission-tracker-template.csv' as a suggested destination for product information submission.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent or user to execute network-enabled shell commands to verify backlink status. Specifically, 'SKILL.md' suggests using 'curl -sIL https://directory.com/your-listing | grep -i rel=' to inspect HTTP headers and link attributes.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data to generate marketing content. 1. Ingestion points: The skill reads from '.agents/product-marketing-context.md' and positioning templates in 'references/positioning-variations.md'. 2. Boundary markers: There are no explicit instructions or delimiters used to prevent the agent from executing commands or following instructions potentially embedded in the ingested marketing descriptions. 3. Capability inventory: The skill directs the agent to perform network-based verification using 'curl' in 'SKILL.md'. 4. Sanitization: The skill does not implement validation, escaping, or filtering for the external product context or the target directory URLs.
Recommendations
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata