Security audit

Beta Launch Waitlist Generator

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-only launch marketing skill, with the main caution that users should review any generated outreach or upvote-request copy before sending it.

Install is reasonable for a prompt-only marketing aid. Before using generated copy, verify all claims, testimonials, metrics, deadlines, pricing, and urgency are truthful, and only send outreach where it complies with Product Hunt, email, Slack, Discord, Reddit, and community rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrase "How do I get my first 100 users?" is broad enough to overlap with many general growth or customer-acquisition requests that are not specifically about a beta launch or waitlist campaign. In an agent marketplace, overly broad activation criteria can cause unintended routing or invocation, leading the skill to respond outside its intended scope and potentially override a more appropriate skill.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The statement "We're launching next month and I don't have a plan" is ambiguous because it could apply to many launch types beyond this skill's specialty, including events, courses, services, or internal releases. This increases the chance of accidental activation for unrelated requests, creating misrouting and lowering the reliability and safety of skill selection.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation example about opening enrollment in 6 weeks is broad enough to match general campaign planning for courses, communities, or events, not just the intended beta/waitlist workflow. In context, this skill markets itself as broadly applicable across SaaS, courses, communities, and hardware, which makes loose triggers more dangerous because they widen activation beyond a tightly bounded task.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill describes broad marketing and launch-generation capabilities but does not define clear activation boundaries, allowed contexts, or limiting trigger conditions. In an agent environment, this ambiguity can cause the skill to be invoked too broadly for generic marketing or outreach tasks, increasing the chance of unintended persuasive-content generation or misuse in contexts the user did not explicitly authorize.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The Product Hunt section explicitly includes hunter outreach, upvote-ask DMs, email blasts, and a playbook for pushing upvotes, but provides no safeguards around platform rules, anti-spam requirements, disclosure, or user-trust concerns. This creates a meaningful risk that the skill will help generate manipulative or policy-violating promotion workflows that could facilitate spammy outreach, vote manipulation, or deceptive engagement tactics.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.