USA Business Migration Planner

• Outcome: Review
• Latest audit: Jul 24, 2026 · 5:20 PM UTC
• Version: 0.1.0

Overview

The skill’s name says it is for USA business migration planning, but the actual instructions are about V2EX/Codex promotion and token-credit workflows.

Review this before installing. It appears non-executable and does not show credential or data-access behavior, but it is mislabeled: use it only if you actually want help with Codex/API promotion-token workflows, not USA business migration planning. Be cautious about acting on any third-party API relay or promotional claims it references.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file title names the skill 'USA Business Migration Planner', which implies business relocation or migration planning. However, the requirement, evidence, and trigger phrases consistently center on V2EX promotions, Codex Pro pools, token giveaways, and API-related offers, which is a materially different purpose than USA business migration planning.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is named and titled as a 'USA Business Migration Planner' (L02, L07), which implies guidance for business relocation or migration planning. However, the manifest description and requirement text instead focus on handling a promotion-like topic involving V2EX, Codex Pro pool pricing, signup credits, and tokens (L03-L04, L11-L18), which is semantically unrelated to business migration planning.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The document heading and surrounding sections frame the skill as 'USA Business Migration Planner' with a general workflow for helping users on that topic (L07-L40). Yet the requirement statement, keywords, and example triggers all direct the skill toward unrelated software/promotion/Codex token content (L13, L44-L50), actively contradicting the documented intent rather than merely omitting detail.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file identifies the skill as "usa-business-migration-planner" and titles it "USA Business Migration Planner," which implies a skill focused on US business relocation or migration planning. However, the description, trigger keywords, and examples consistently describe helping users with promotional/Codex/token-related content, not business migration planning, creating a clear semantic mismatch between the claimed skill purpose and the documented behavior.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is named 'usa-business-migration-planner', which implies assistance with U.S. business migration planning, yet the file's live requirement, evidence, keywords, and trigger sentences all focus on handling a V2EX post about Codex Pro pool promotions and token credits. This is a clear semantic mismatch between the claimed skill purpose in the manifest context and the actual documented behavior of the skill.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.