skills/yan-labs/yan-skills/backlink/Gen Agent Trust Hub

backlink

Fail

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: CRITICALDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses a pattern of dynamic code generation for browser-based tasks. Javascript functions are defined as strings or serialized from local functions and then executed in the context of the user's browser using opencli eval.
  • scripts/lib-deep-dom.mjs defines DEEP_DOM_JS, which includes functions for piercing Shadow DOM and performing page census, which are injected into nearly every automated report run.
  • scripts/safe-fill.mjs and scripts/submit-known.mjs generate and execute complex logic for identifying and populating form fields based on project payloads.
  • [EXTERNAL_DOWNLOADS]: The skill connects to multiple external services for data acquisition.
  • It hardcodes and utilizes https://dash.3ue.co as a centralized entry point for accessing proxied SEO tool subscriptions.
  • scripts/footprint-discover.mjs supports interaction with the Serper.dev API (https://google.serper.dev) for footprint-based discovery.
  • An automated scan identified https://submitaitools.org/ as a malicious URL and flagged the containing file data/paid-platforms.json as malware, possibly due to the inclusion of low-reputation SEO sites.
  • [DATA_EXFILTRATION]: The core functionality involves transmitting site and contact information to various third-party domains.
  • Automated submission scripts in Lane A (adapter-phpld-submit.mjs) and recipes (submit-known.mjs) send project details (URLs, descriptions, emails) to external directory and blog platforms.
  • The probe-submission-targets.mjs script performs automated HTTP requests to large numbers of candidate URLs gathered from third-party lists.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 17, 2026, 02:54 AM
Security Audit — agent-trust-hub — backlink