Ecommerce Ad Copy Generator

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward paid ad-copy generator that discloses its SkillPay charge and does not show hidden persistence or data harvesting.

Install only if you intend to use a paid SkillPay-backed generator. Each run may charge 0.10 USDT and sends user ID, product name, and target audience to the billing endpoint; keep SKILLPAY_API_KEY private and leave endpoint variables pointed only at trusted SkillPay URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities that require network access, environment variable access, and file reading, but it does not declare any permissions or capability boundaries. This creates a least-privilege and transparency failure: reviewers and runtime policy systems cannot accurately assess or constrain what the skill can access, increasing the risk of unintended data exposure, unauthorized outbound requests, or misuse of secrets from environment variables.

VirusTotal

66/66 vendors flagged this skill as clean.