Movie Poster Generator

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:38 PM UTC
• Version: 1.0.1

Overview

This appears to be a normal cloud image-generation skill, but users should understand that prompts are sent to an external API and the token handling guidance is weak.

Install only if you are comfortable sending poster prompts and optional reference identifiers to the external TalesOfAI API. Prefer using an environment variable or secret manager for the API token instead of pasting it into a command line, and avoid including private, personal, or regulated data in prompts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises use of a third-party API token and a Node script invocation, which strongly implies outbound network access, yet no permissions are declared. This creates a transparency and trust problem: users and hosting platforms are not clearly informed that the skill can send prompts and credentials to an external service.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README explicitly tells users to supply an API token via a command-line flag, which can expose the credential through shell history, process listings, logs, screenshots, or CI job output. Because this is a usage instruction in end-user documentation, it meaningfully increases the chance that users will handle secrets insecurely even if the underlying code is otherwise harmless.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger guidance, 'Use when someone asks to generate or create movie poster generator images,' is broad and poorly scoped, which can cause the skill to activate in contexts the user did not specifically intend. Over-broad invocation increases the chance that user content or prompts are sent to the external image API unnecessarily.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to pass an API token on the command line but provides no warning about credential exposure. Command-line secrets may be captured in shell history, process listings, logs, or transcripts, making accidental disclosure more likely.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends the user's prompt and optional reference identifiers to a third-party API, but its usage text does not clearly warn that user-supplied content will leave the local environment. In an agent-skill context, prompts may contain sensitive data provided by users or upstream tools, so undisclosed external transmission creates a real privacy and data-handling risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

console.error(`\u2139 Prompt: "${prompt}"`);

  // Submit the image generation task
  const createRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

• Confidence: 94% confidence
• Finding: fetch("https://api.talesofai.com/v3/make_image", { method: "POST"

External Transmission

Medium

• Category: Data Exfiltration

Content

console.error(`\u2139 Prompt: "${prompt}"`);

  // Submit the image generation task
  const createRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

• Confidence: 94% confidence
• Finding: https://api.talesofai.com/

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.