Modelslab : Generate Video, Images, LLMs using CLI and APIs

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.0.0

Overview

The skill bundle is transparent about using ModelsLab, but it gives agents broad account and payment authority, including headless card handling and billable actions, without enough safety boundaries.

Install only if you intentionally want an agent to manage ModelsLab generation, account, and billing workflows. Use a dedicated low-privilege account, keep API keys and bearer tokens out of logs, require explicit human approval for every payment, subscription, auto-recharge, team, token, and API-key change, and prefer human-assisted checkout over giving an agent raw card details.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (67)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is scoped as account management, but it embeds a broader headless flow for billing, subscription purchase, and content generation. This expands the operational authority of any agent using the skill and increases the chance of unintended financial actions or misuse beyond the user's expected consent boundary.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documentation includes direct payment-card handling and subscription creation even though the skill's declared purpose is account management. Combining account bootstrap with payment enrollment and purchasing creates a dangerous overprivileged workflow that could enable unauthorized charges or policy bypass if an agent follows the example literally.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill contains contradictory guidance about whether agents may supply a subscription `success_url`. In billing flows, ambiguity around redirect control can lead agents to depend on insecure assumptions, potentially enabling open-redirect style misuse, broken confirmation handling, or leaking checkout/session information to unintended destinations if the backend does honor the field.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The primary webhook handler examples accept POSTed JSON and immediately trust fields like status, output, track_id, and id without authenticating the sender or verifying a signature. An attacker could spoof webhook callbacks to mark jobs complete or failed, inject attacker-controlled result URLs, trigger downstream processing, or corrupt application state.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill sends prompts, image URLs, and API keys to a third-party service, but the description does not clearly warn users that their data will leave the local environment. In an agent-skill context, this can cause unintentional disclosure of sensitive prompts, proprietary images, or credentials to an external provider without informed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README advertises account-management and billing capabilities that include signup, API key CRUD, wallet funding, subscriptions, and payment-related operations, but it does not warn that these actions can create persistent accounts, rotate credentials, or trigger financial changes. In an agent-skill context, documenting powerful side-effecting capabilities without explicit confirmation and safety guidance increases the chance an agent will perform sensitive operations automatically or on ambiguous user prompts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The example prompts explicitly encourage actions such as signing up for an account, creating an API key, checking wallet balance, and funding the wallet, but they provide no warning that these are sensitive credential-management or billing operations. Because prompt examples are likely to be copied verbatim by users or interpreted by agents as endorsed workflows, this materially increases the risk of unintended account creation, credential issuance, or charges.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document advertises headless signup, API key CRUD, team management, billing operations, wallet funding, and direct subscriptions without any caution that these actions can create credentials, modify account state, or incur real charges. In an agent-skill context, that omission increases the risk that a user or autonomous agent triggers sensitive account and payment actions without explicit informed consent or confirmation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The example prompts normalize sensitive operations such as creating an API key and funding a wallet without warning that they affect credentials and billing. In a coding-agent environment, examples strongly shape agent behavior, so these prompts can encourage autonomous execution of high-impact actions without adequate approval gates.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples print full access tokens and API keys directly to output, which can leak secrets into logs, terminals, traces, or chat transcripts. Anyone with access to those outputs could reuse the credentials to control the account or invoke paid APIs.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The headless payment example shows raw card number, expiry, and CVC handling without any warning about payment-data sensitivity or PCI obligations. This encourages agents or developers to process cardholder data directly, which can lead to severe compliance, leakage, and fraud risks if logs, telemetry, or memory are exposed.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill instructs users to send audio and audio URLs to a third-party service for transcription and voice processing without an explicit privacy or data-transmission warning. Because speech content may contain personal, sensitive, or regulated data, users could unknowingly disclose private audio to an external processor.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The headless payment examples normalize direct handling of raw card number, expiry, and CVC by the agent without a strong warning about PCI scope, logging exposure, memory retention, or accidental disclosure through traces and prompts. Even though data is sent to Stripe, the agent still processes highly sensitive payment data locally, which materially raises the risk of credential leakage and compliance violations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The examples perform immediate wallet funding and enable automatic charging with little emphasis that these are real billable actions, not dry-run samples. In an agent-skill context, copy-pasted examples can trigger unintended charges, repeated top-ups, or autonomous spending behavior if operators treat them as harmless demonstrations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to send prompts, conversation history, system prompts, and API keys to a third-party service, but it does not include a clear privacy or data-transmission warning. This can cause users to unknowingly transmit sensitive data or credentials off-platform, especially because the examples normalize sending arbitrary chat content and conversation context to the external provider.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill promotes deepfake and face-swap operations while sending user media and API credentials to a third-party service, but it does not provide an upfront, prominent warning about privacy, consent, and external data sharing. In this context, the omission is significant because the functionality processes highly sensitive biometric/identity-related content that can enable impersonation, reputational harm, or non-consensual manipulation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The webhook example sends processing results and tracking metadata to an external callback endpoint without clearly warning that generated media URLs, request identifiers, and related metadata may be exposed outside the local environment. This is risky because webhook misconfiguration, weak endpoint security, or use of third-party callback infrastructure can leak sensitive deepfake outputs or operational identifiers.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents repeated transmission of user-supplied image URLs and API keys to ModelsLab, a third-party external service, but the description does not clearly warn users that their data leaves the local environment. This creates a real privacy and credential-handling risk because users may unknowingly send sensitive images or production API keys to an external provider.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill sends user prompts, image URLs, and API credentials to a third-party ModelsLab service but does not clearly warn users that their content is transmitted externally. This creates a privacy and data-handling risk, especially if users provide sensitive prompts or private image links under the assumption processing is local.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill repeatedly instructs users to send room/building image URLs, prompts, and API keys to ModelsLab, but the description does not warn that potentially sensitive interior/exterior images and associated prompts are transmitted to a third-party service. In this context, users may submit private home, office, or building imagery without understanding the privacy and data-sharing implications, making the omission a real privacy/security issue.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill includes a face-swap/deepfake example with no warning, consent requirement, or abuse-limiting guidance. In a developer-facing integration guide, this can normalize deployment of impersonation-capable media manipulation without safeguards, increasing misuse risk for harassment, fraud, or non-consensual synthetic media generation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly encourages sending image, video, and audio inputs to a third-party ModelsLab service but does not warn users that prompts and referenced media may contain sensitive or regulated data. In a media-processing skill, this omission materially increases privacy and compliance risk because users may unknowingly transmit personal faces, voices, or confidential content off-platform.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill encourages exposing a public webhook endpoint and wiring it into API requests, but the introductory examples omit any warning or control for callback authenticity, replay protection, or safe handling of inbound data. Because these are the examples users are most likely to copy, the documentation materially increases the chance of deploying an unauthenticated internet-facing endpoint that trusts attacker-supplied payloads.

External Transmission

Medium

• Category: Data Exfiltration

Content

audio_url: URL of audio file (must be publicly accessible)
        model_id: STT model to use
    """
    response = requests.post(
        "https://modelslab.com/api/v7/voice/speech-to-text",
        json={
            "key": api_key,

• Confidence: 84% confidence
• Finding: This duplicate finding points to the same speech-to-text request. Because it transmits audio references and credentials to an external provider without a prominent privacy warning, it presents a legitimate data-exposure concern in the skill context.

External Transmission

Medium

• Category: Data Exfiltration

Content

voice_id: Target ElevenLabs voice ID
        model_id: Voice conversion model
    """
    response = requests.post(
        "https://modelslab.com/api/v7/voice/speech-to-speech",
        json={
            "key": api_key,

• Confidence: 86% confidence
• Finding: This duplicate finding concerns the same speech-to-speech request. Sending voice recordings for conversion can expose sensitive personal audio and raise consent issues, making the lack of clear privacy guidance a meaningful security concern.

VirusTotal

64/64 vendors flagged this skill as clean.