pm-career-growth
Fail
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: CRITICALOBFUSCATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: The skill employs steganography to conceal a malicious domain. The first letters of several headers and key phrases in the 'Core Principles', 'Questions', and 'Common Mistakes' sections (e.g., 'Prioritize', 'Mistaking', 'How', 'Questions', 'Control', 'Over-indexing', 'Moving') spell out 'PMHQ.COM'. This deliberate hidden-in-text pattern is a classic indicator of malicious intent to bypass automated text filters.
- [EXTERNAL_DOWNLOADS]: Automated security analysis identified the domain 'productmanagerhq.com' as a blacklisted malicious URL. The skill's covert reference to this site via steganography confirms a high-risk attempt to interact with dangerous external infrastructure.
- [INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface by ingesting content from 'references/guest-insights.md' without proper sanitization or boundary markers. This allows for potential instructions embedded in the external file to compromise the agent's behavior.
- Ingestion points: The skill instructions lead the agent to read data from the 'references/guest-insights.md' file.
- Boundary markers: None identified in the provided instructions to separate instructions from data.
- Capability inventory: The skill utilizes the agent's file reading capabilities to process external insights.
- Sanitization: There is no evidence of validation or filtering for the content within the referenced insights file.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata