Content Multiply Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.4

Overview

The skill does what it advertises, but it sends user content to an opaque external API and points users to an unverified payment path without enough privacy or operator disclosure.

Review before installing. Use this only with public or approved-for-sharing content unless the publisher identifies the API operator, privacy terms, retention/deletion practices, and payment flow. Do not submit confidential drafts, customer data, internal transcripts, or regulated information to the listed endpoint without separate assurance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:39

Finding

Source Content May Be Disclosed to an Unverified Third-Party API

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-43
Vulnerability Type: Untrusted external service / potential information disclosure
Risk Level: Medium

Vulnerable Content:

markdown

## API

Uses a web-based content API at https://extant-torrie-nonrepealable.ngrok-free.dev.

Buy credits at /buy if the API returns a 402 response.

Technical Analysis

The skill declares that content processing uses an externally hosted API on an opaque, temporary-looking ngrok-free.dev subdomain. The documentation does not identify the service operator, provide privacy or retention terms, describe what information is transmitted, or require informed user consent before source content is submitted.

The skill is intended to process blog posts, podcast transcripts, videos, and potentially internal memos. Such input may contain confidential, proprietary, personal, or unpublished information. Sending this material to an unverified service creates a third-party disclosure risk. The recommendation to purchase credits through the same endpoint additionally exposes users to an unverified payment destination.

The reviewed package contains no executable source code, so the exact request implementation, transport payload, server-side retention, and payment workflow cannot be verified from the available files. There is no evidence that the endpoint retrieves or executes code; therefore, this issue is not classified as remote payload execution.

Attack Path

1. A user supplies private or proprietary source content to a web-connected agent using this skill.
2. Following the skill documentation, the agent submits that content to the specified ngrok-free.dev API.
3. The external service operator receives the submitted content and associated request metadata.
4. If the service is malicious, compromised, or inadequately secured, it may retain, inspect, reuse, or disclose that information.
5. If an HTTP 402 response occurs, the user may also be dir ...[truncated 706 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the temporary or opaque tunnel URL with a stable domain controlled by a verified service operator.
• Clearly identify the API operator and publish privacy, retention, deletion, subprocessors, and security policies.
• Obtain explicit user consent before transmitting source content externally, including a clear description of the data and destination.
• Minimize transmitted data and redact credentials, personal information, internal material, and unrelated metadata before submission.
• Provide a local-processing option for sensitive content.
• Document request fields, authentication behavior, logging, retention periods, and deletion procedures.
• Apply strict TLS certificate validation, request timeouts, response-size limits, and destination allowlisting in any implementation that calls the API.
• Do not direct users to an unverified payment endpoint. Use a recognized payment processor on a stable, authenticated domain and clearly identify the merchant.
• Add warnings advising users not to submit confidential or regulated information unless suitable contractual and technical safeguards are in place.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly routes user-provided source content and URLs to an external web API, but it does not clearly warn users that their data will leave the agent and be sent to a third-party service. This creates a real privacy and data handling risk, especially because users may paste unpublished drafts, internal transcripts, proprietary marketing plans, or sensitive URLs without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.