The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The directory reference file (references/directory-list.md) includes the domain https://fitprofessionals.net, which has been blacklisted by automated security scanners (e.g., URLite). Interaction with blacklisted domains carries a high risk of exposure to malicious payloads, phishing attempts, or drive-by downloads.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute network-related shell commands, including curl -fsSL for fetching external HTML and dig +short for DNS verification. These commands are applied to external targets provided in the directory list, creating opportunities for unauthorized network reconnaissance or interaction with malicious infrastructure.
[INDIRECT_PROMPT_INJECTION]: The core workflow requires the agent to fetch, inspect, and parse HTML content from third-party websites to verify the presence and attributes of backlinks. This process exposes the agent to indirect prompt injection, where an attacker-controlled directory could embed malicious instructions in its source code to hijack the agent's behavior. While the skill includes a warning to treat external data as untrusted, the structural vulnerability remains.
[MALICIOUS_FILE]: Automated reputation scanners flagged the file references/submission-tracker-template.csv as malicious (FileRepMalware). Even if the visible content appears to be a standard tracker structure, such reputation alerts indicate that the file matches known malicious signatures or has been associated with harmful activities in other contexts.

directory-submissions