AI Content Repurposer Pro

• Outcome: Review
• Latest audit: May 29, 2026 at 9:26 PM UTC
• Version:
  1.0.0

Overview

This skill appears to do AI content repurposing, but it needs review because its install identity is inconsistent and it sends user content to OpenAI without clear disclosure.

Review before installing. Confirm you are installing the exact reviewed skill rather than a similarly named npm or ClawHub package, use a restricted OpenAI API key, avoid submitting confidential or regulated content unless OpenAI processing is acceptable, and only run batch configs you trust after checking job names and output paths.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README instructs users to provide an OpenAI API key and use AI-powered transformations, which strongly implies content will be sent to an external service, but it does not explicitly warn that user-provided transcripts, blog text, or podcast content may leave the local environment. This creates a real privacy and compliance risk because users may submit proprietary, confidential, or regulated content without understanding that it is transmitted to a third-party AI provider over the network.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly requires an OpenAI API key and describes AI-powered transformations, which strongly implies user-provided content will be sent to a third-party service for processing. Without a clear warning about external transmission, users may unknowingly upload sensitive transcripts, blog drafts, podcast material, or client content, creating a privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The manifest requires an OPENAI_API_KEY but does not disclose how that credential will be used or that user content may be transmitted to an external AI provider. In a content-repurposing skill, users are likely to submit unpublished marketing material, podcasts, or client content, so the lack of clear notice creates a real risk of unintended data exposure and uninformed credential sharing.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code fetches arbitrary blog content from a URL and the class is designed to pass supplied content into the OpenAI API for transformation, but there is no explicit user-facing notice, consent gate, or data-handling control before external transmission. This creates a privacy and compliance risk because users may not realize third-party or sensitive text is being sent to an external processor.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The _callAI method sends user-provided transcript and blog text directly to the OpenAI chat completions endpoint, and nothing in the code informs the user that their content leaves the local environment. This is dangerous in contexts where transcripts or articles may contain proprietary, personal, or regulated data, creating confidentiality and compliance exposure.

VirusTotal

64/64 vendors flagged this skill as clean.