ai-content-creator-pro

• Outcome: Pass
• Latest audit: Jul 28, 2026 · 4:51 PM UTC
• Version: 1.0.1

Overview

This paid content-generation skill is transparent about its buyout payment flow and local files, though users should know it stores their question and purchase state locally.

Install only if you are comfortable with a paid buyout workflow that stores your question, order metadata, and purchase credential locally. Do not include passwords, secrets, or sensitive personal content in the question, and verify the clawtip recipient configuration before paying.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill is marketed primarily as a content-generation tool, but the documented workflow includes payment/order creation, local persistence of the user's question, and creation of a durable buyout credential. This mismatch is security-relevant because users may disclose sensitive prompts or approve filesystem/payment-related actions without understanding that their input is being stored locally and used in a payment-gating flow.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script’s functionality goes beyond content generation and implements payment order creation plus local storage of billing-related data, including the user’s question. That expanded capability increases privacy and abuse risk because a seemingly harmless content skill is also handling transaction metadata and persisting user-supplied content on disk.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Reading payment recipient and encryption key material from environment variables introduces sensitive capability unrelated to ordinary content creation. In this skill context, that means the code can direct payments and process protected billing payloads without those privileged behaviors being obvious from the advertised purpose.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script’s behavior materially diverges from the advertised skill purpose: instead of generating content, it implements payment verification and a local buyout gate. This mismatch is security-relevant because users and reviewers may grant permissions or trust based on the declared functionality, while the code performs unrelated stateful commerce logic and alters local files.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill stores a persistent local buyout credential file under the user’s home directory, even though the stated purpose is content creation. Unnecessary persistence of payment-related state expands the attack surface: other local processes or later executions can rely on or tamper with this file to bypass checks, leak purchase metadata, or create misleading entitlement state.

Session Persistence

Medium

• Category: Rogue Agent

Content

return order_data

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="Create ai-content-creator-pro buyout order")
    parser.add_argument("question", help="User question / consultation content")
    args = parser.parse_args()
    indicator = compute_indicator(SLUG)

• Confidence: 84% confidence
• Finding: Create ai-content-creator-pro buyout order") parser.add_argument("question", help="User question / consultation content") args = parser.parse_args() indicator = compute_indicator(SLUG)

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.