Security audit

Xianyu Auto Seller

Security checks across malware telemetry and agentic risk

Overview

This markdown-only marketplace helper needs review because it normalizes selling cracked or unauthorized digital goods and provides auto-delivery templates without rights checks.

Before installing, review the skill carefully and use it only for digital products you created or have explicit rights to distribute. Do not use it to sell cracked software, unauthorized courses, copyrighted eBooks, exam materials, or other third-party content without permission.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill explicitly identifies reselling others' courses and cracked software as a 'gray area' rather than clearly prohibiting it, which normalizes potentially infringing distribution. In a skill focused on generating marketplace listings and auto-delivery flows, this materially lowers the barrier to selling unauthorized third-party digital goods.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The templates provide turnkey wording for automated delivery of eBooks and study materials via cloud links without requiring proof of ownership or distribution rights. Because these categories are commonly associated with unauthorized redistribution, the skill can facilitate infringement at scale even if it does not explicitly instruct users to pirate content.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.