Pattern

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent marketing purpose, but it needs review because the runnable worker sends product data to an under-disclosed Anthropic service, exposes an unauthenticated web endpoint, and persists Drive links in a broad cache.

Review before installing or running. Use only with product images and metadata that may be sent to Anthropic and Google, add authentication and URL allowlisting before exposing the FastAPI worker, restrict the Google service account to a dedicated Drive folder, and disable or re-scope the Redis cache in shared environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises no declared permissions while its documented and detected behavior requires network access and likely environment-based secrets for external APIs. This is dangerous because it obscures the true trust boundary: users and reviewers cannot accurately assess that the skill can fetch remote content, call third-party services, and use credentials, increasing the chance of unnoticed data exfiltration or unsafe deployment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description says the skill uses Vertex AI and Google Drive, but the detected behavior includes undisclosed Anthropic API usage, arbitrary external image downloads, Redis caching, and an exposed webhook/API endpoint. Hidden capabilities materially change the risk profile because they introduce additional third-party data sharing, SSRF-like fetch risks, persistent storage of user content, and remote attack surface that users were not informed about.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill introduces an external Anthropic API dependency that is not reflected in the stated purpose or top-level metadata, creating an undisclosed third-party data flow. That matters because product details, prompts, and potentially derived business data may be transmitted to a provider users did not consent to, undermining transparency and data governance.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill output includes a Google Drive link and the workflow states assets are uploaded to Google Drive, potentially to a public or internal folder, but users are not clearly warned that submitted images and generated content may be stored and shared there. In a marketing workflow handling product imagery and metadata, undisclosed upload destinations can lead to unintended disclosure of proprietary assets, embargoed product launches, or internal business data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill maintains persistent memory fields and a 30-day cache keyed on incoming images and metadata, but the description does not present this as a meaningful user warning. This creates privacy and data governance risk because product images, captions, metadata, and performance-related text may be retained and reused beyond a single run, potentially exposing sensitive commercial information or user-associated content across sessions.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest defines a multi-step automation pipeline that sends product images and metadata to external AI and storage services, but it does not state what user action, approval gate, or invocation scope is required before execution. Without explicit trigger constraints or boundaries, an integrating agent could invoke the skill too broadly or automatically, increasing the risk of unintended data processing and external transmission.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill processes product photographs and business metadata through Google Vertex AI and stores generated assets in Google Drive, yet the manifest provides no user-facing disclosure or warning about these external data transfers and retention. This can cause users to unknowingly expose proprietary product imagery, pricing, SKU data, or marketing content to third-party services and cloud storage, creating privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill sends user-supplied product imagery and metadata to Anthropic for prompt generation, but the skill description emphasizes Google services and does not clearly disclose this third-party transfer. In a marketing pipeline handling proprietary product images or sensitive business metadata, undisclosed transmission to an additional external processor creates privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Product names and metadata are transmitted to Anthropic to generate copy without visible disclosure to users of the skill. In this context, the data may include embargoed product details, pricing cues, campaign strategy, or internal catalog metadata, so silent third-party sharing is more dangerous than in a purely local content generator.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill uploads generated images and text to Google Drive using service-account credentials without explicit disclosure of storage location or sharing behavior. Even if intended, silent external persistence can create confidentiality and governance issues, especially for marketing assets tied to unreleased products or restricted campaigns.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The design uploads generated assets and metadata to Google Drive persistently, yet the skill provides no user-facing disclosure or consent mechanism for that external storage. This is dangerous because images, captions, and product metadata may be retained outside the immediate execution context, increasing privacy, confidentiality, and data-retention risk.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.