directory-submissions
Fail
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Automated scanners identified the domain 'https://fitprofessionals.net', included in the skill's directory list, as a blacklisted malicious URL.\n- [REMOTE_CODE_EXECUTION]: The file 'references/submission-tracker-template.csv' has been flagged by reputation scanners as containing malicious content (FileRepMalware), posing a direct threat to the execution environment.\n- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using 'curl -sIL' on user-provided or directory-sourced URLs. Given the inclusion of malicious domains in the provided references, this facilitates interaction with hostile infrastructure.\n- [INDIRECT_PROMPT_INJECTION]: The skill maintains an attack surface for indirect prompt injection.\n
- Ingestion points: Reads product marketing context from files such as '.agents/product-marketing.md' and '.claude/product-marketing.md' (SKILL.md).\n
- Boundary markers: None implemented to delimit external context from instructions.\n
- Capability inventory: Includes capabilities for network requests via 'curl' and tracking progress in local CSV files.\n
- Sanitization: No input validation or sanitization is performed on the ingested marketing data.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata