Pinterest Trends Dashboard

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:31 PM UTC
• Version:
  1.0.0

Overview

The skill appears purpose-aligned for affiliate marketing analytics, with privacy and third-party script caveats but no evidence of hidden or destructive behavior.

Install only if you are comfortable with affiliate-link analytics and third-party assets in the mockup. Add or look for clear privacy language explaining click tracking, affiliate parameters, third-party data sharing, retention, and opt-out controls before using it with real users.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This mockup loads executable JavaScript and fonts from multiple third-party CDNs, including React, ReactDOM, Tailwind, and Babel, without integrity pinning or local bundling. If any upstream CDN asset is tampered with, or if requests leak metadata to third parties, users opening the file could be exposed to supply-chain compromise or privacy leakage.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly includes tracking click-through rates to ClickBank affiliate links as a success metric, but the specification does not mention any user notice, consent flow, privacy disclosure, or analytics minimization controls. In a dashboard tied to affiliate marketing automation, undisclosed outbound-link tracking can collect behavioral data and create privacy/compliance exposure, especially if combined with saved niches, email alerts, or future user accounts.

VirusTotal

64/64 vendors flagged this skill as clean.