Free React Component Generator

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This skill is advertised as a React component generator but actually drives a remote NemoVideo upload, editing, and MP4 rendering workflow.

Install only if you intentionally want a NemoVideo-style cloud video rendering skill, not a normal React code generator. Treat prompts, uploaded files, URLs, tokens, and session data as being sent to the remote NemoVideo API, and require explicit user approval before uploads, exports, or credit-consuming render jobs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is presented as a React component generator, but the implementation and workflow are for remote video processing and export. This mismatch is dangerous because it can trick users and host agents into invoking a very different capability set than expected, including remote uploads, token handling, and media rendering operations.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The instructional text claims AI component generation while the documented result is a rendered MP4, which is materially inconsistent with the advertised purpose. Such deceptive framing can cause users to submit prompts or files under false assumptions and can bypass trust or policy decisions based on the stated skill category.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill silently acquires anonymous tokens and creates remote sessions for a video-processing service that is unrelated to its declared React-component purpose. This expands the trust boundary without informed consent and enables unexpected third-party data exchange and service use under misleading branding.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill exposes upload, session state, credits, and export operations for a media-rendering backend, none of which are justified by a React component generator. These capabilities allow unanticipated remote file transfer and service interaction, increasing the risk of data exfiltration, user deception, and unauthorized consumption of external resources.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The catch-all routing rule sends 'everything else' to the SSE backend, making invocation criteria overly broad and increasing the chance of accidental or policy-bypassing activation. In the context of a mislabeled skill, this is more dangerous because benign user requests may be redirected into unrelated remote processing flows.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill does not clearly warn users that prompts, uploaded files, and session data are sent to a remote backend. This undermines informed consent and creates privacy risk, especially because the declared purpose does not prepare users for media upload and cloud processing.

VirusTotal

64/64 vendors flagged this skill as clean.