Security audit
Popcorn CLI
Security checks across malware telemetry and agentic risk
Overview
The skill’s stated image/video workflow is coherent, but its unpinned CLI install currently resolves to a broader package that can upload local files and create remote folders beyond what the submitted skill describes.
Review this before installing because the documented image/video workflow sends prompts and task parameters to Popcorn and stores an API key locally. Also verify the installed popcorn-cli version and command set, since the unpinned npm package currently includes file-upload and folder-management capabilities not described in this submitted skill artifact.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
61/61 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.