directory-submissions

Fail

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes a reference to an external URL that has been flagged as a phishing site by security scanners. The URL 'https://aiagentsverse.com/submit' is listed in 'references/directory-list.md' and 'references/submission-tracker-template.csv' as a suggested destination for product information submission.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent or user to execute network-enabled shell commands to verify backlink status. Specifically, 'SKILL.md' suggests using 'curl -sIL https://directory.com/your-listing | grep -i rel=' to inspect HTTP headers and link attributes.
  • [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data to generate marketing content. 1. Ingestion points: The skill reads from '.agents/product-marketing-context.md' and positioning templates in 'references/positioning-variations.md'. 2. Boundary markers: There are no explicit instructions or delimiters used to prevent the agent from executing commands or following instructions potentially embedded in the ingested marketing descriptions. 3. Capability inventory: The skill directs the agent to perform network-based verification using 'curl' in 'SKILL.md'. 4. Sanitization: The skill does not implement validation, escaping, or filtering for the external product context or the target directory URLs.
Recommendations
  • AI detected serious security threats
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Apr 22, 2026, 04:29 AM