Demo Video Creator

• Outcome: Pass
• Latest audit: May 27, 2026, 9:28 PM
• Version:
  1.0.0

Overview

This is a legitimate demo-recording skill, but it can capture visible browser content and replace files in its configured demo output locations.

Install only if you are comfortable with a script controlling a browser and recording its visible contents. Use a dedicated demo profile and sanitized data, confirm the target page before recording, keep output paths pointed at disposable demo folders, and review or delete generated frames and videos before sharing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises browser-based recording but does not warn that automated capture can record sensitive on-screen data such as tokens, internal dashboards, personal data, or other confidential UI elements visible during the session. In this context, the omission matters because the skill is explicitly designed to capture frames from a live browser session and produce shareable media, increasing the chance of accidental disclosure.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The documentation explains how to save frames and encode videos but does not warn users that screenshots and encoded outputs are persisted to disk as user-visible artifacts. This can expose sensitive information through local files, backups, shared workspaces, or accidental publication, especially because demo assets are commonly redistributed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script invokes ffmpeg with the -y flag, which unconditionally overwrites an existing output file without prompting. If the caller supplies an output name that matches an important file in the working directory, prior content can be silently destroyed, causing data loss; in an automation context this is more likely because runs may be unattended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script unconditionally deletes the configured output directory with fs.rmSync(outputDir, { recursive: true }) before recreating it. Because the path is configurable and resolved at runtime, a mistaken or modified outputDir value could cause unintended data loss by recursively removing arbitrary local directories without confirmation or safety checks.

VirusTotal

66/66 vendors flagged this skill as clean.