stacktree-custom-domain
Fail
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: CRITICALDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill requires the agent to collect and transmit sensitive personal identifiable information (PII) to an external service.
- Evidence: The instructions for
POST /api/profileatstabledomains.devmandate the collection offirstName,lastName,email,addressLine1,city,state,postalCode, andcountry. - This data is submitted to a third-party domain that is not recognized as a trusted provider and interacts with other flagged domains.
- [EXTERNAL_DOWNLOADS]: The skill relies on external domains that have been explicitly flagged by security scanners for malicious content.
- Evidence: Automated scanners detected multiple phishing URLs associated with the
stacktr.eedomain used throughout the skill. - The file
SKILL.mditself has been flagged by reputation scanners as containing malware patterns. - [DATA_EXFILTRATION]: The skill instructs the agent to initiate financial transactions (USDC payments) through the x402 protocol to unverified external endpoints.
- Evidence: It directs the agent to perform crypto payments for domain registration at
stabledomains.devand feature unlocking atapi.stacktr.ee. - The lack of human oversight (described as "no human in the loop") increases the risk of unauthorized financial asset transfer to malicious entities.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 5 malicious URL(s) - DO NOT USE
Audit Metadata