directory-submissions
Fail
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a directory list and a tracker template that reference the domain 'fitprofessionals.net'. This URL is currently blacklisted and has been flagged as malicious by security scanners. Recommending and providing links to such domains can lead to malware exposure or phishing attacks.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from local project files, such as '.agents/product-marketing.md', which provides a surface for indirect prompt injection.
- Ingestion points: The skill reads context from '.agents/product-marketing.md', '.claude/product-marketing.md', and 'product-marketing-context.md'.
- Boundary markers: There are no instructions or delimiters defined to separate untrusted content from these files or to warn the agent against following instructions embedded within them.
- Capability inventory: The skill includes instructions for the agent to perform network verification tasks using shell commands like 'curl'.
- Sanitization: There is no specified mechanism for sanitizing or validating the data retrieved from external context files before it is used to guide the agent's actions.
Recommendations
- CRITICAL: 2 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata