Content Creation Pro

Security checks across malware telemetry and agentic risk

Overview

This is a content-drafting helper with purpose-aligned templates, optional trend-search code, and user-directed file exports, with no evidence of credential theft, account takeover, hidden persistence, or destructive behavior.

Install this as a drafting and planning aid, not an auto-publishing tool. Review generated claims before posting, and do not use confidential client names, unreleased campaign terms, or sensitive internal strategy keywords with the realtime trend-search feature because those keywords may be sent to external sites.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad everyday terms such as '内容创作', '社交媒体', and '生成内容', which can cause the skill to activate in conversations where the user did not intend to invoke it. Unintended activation can redirect user requests, cause confusing behavior, and potentially expose user content or workflow context to a skill that was not explicitly selected.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The function transmits user-supplied keywords to third-party platforms, which can leak sensitive prompts, business plans, or internal terms if users assume processing is local. In this skill context, the feature is marketed as content assistance, so undisclosed outbound requests increase privacy risk because users may not expect their inputs to be sent externally.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal