Renderful AI

• Outcome: Review
• Latest audit: May 28, 2026 at 2:25 AM UTC
• Version:
  1.0.0

Overview

The skill is mostly a clear Renderful API guide, but it tells agents how to make crypto payments without human approval and does not define spending safeguards.

Install only if you are comfortable with a skill that can call Renderful's paid generation API. Do not enable the x402 wallet settings unless you use a dedicated low-balance wallet and require explicit approval for every paid request; use a dedicated API key and revoke or rotate it after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad generic phrases such as "generate image" and "generate video," which can cause the skill to activate in many unrelated contexts. Because this skill enables outbound API calls and discusses paid generation, unintended invocation can lead to accidental data transmission or unexpected paid actions.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The x402 section explicitly states that an agent can pay directly without human approval, but it does not require clear consent, spending limits, or warning about financial consequences. In an agent skill, this creates a real risk of unauthorized or surprising cryptocurrency expenditure if the skill is invoked automatically or by ambiguous prompts.

VirusTotal

54/54 vendors flagged this skill as clean.