ronacher-pragmatic-design
Fail
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill's main title contains over 240 hidden zero-width characters (\u200b, \u200c, \u200d, \u2060) following the text 'Armin Ronacher Style Guide'. This invisible text is passed directly into the AI model's prompt context. Such techniques are used to inject hidden instructions or bypass safety protocols without the user's knowledge.
- [EXTERNAL_DOWNLOADS]: The obfuscated character sequence in the title decodes to a suspicious external URL: 'https://km2.net/vmw6'. Hiding external links within a skill's text is a high-risk indicator of malicious intent, potentially used for unauthorized data exfiltration or fetching external payloads.
- [REMOTE_CODE_EXECUTION]: The decoded hidden text contains the string 'https://km2.net/vmw6 install'. The inclusion of an 'install' command alongside a hidden URL suggests an attempt to trigger remote code execution or unauthorized software installation on the host system.
Recommendations
- AI detected serious security threats
Audit Metadata