Data Format Converter Free

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only cloud video conversion skill that sends selected media to NemoVideo, with some transparency caveats but no evidence of malicious behavior.

Use this skill only for media you are comfortable sending to NemoVideo's cloud service. Prefer an anonymous or limited token, avoid sensitive personal or confidential videos unless you accept the provider's handling of them, and be cautious with URL uploads because the backend will fetch the supplied resource.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest and branding present the skill as a simple format-conversion utility, but the documented behavior exposes a much broader cloud video-editing workflow with session management, SSE-driven edits, state inspection, credits, and rendering. This scope mismatch can mislead users and hosting platforms about what data is processed and what capabilities are exercised, increasing the risk of overbroad data handling and unintended invocation.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill supports URL-based media ingestion in addition to user-uploaded files, but this is not clearly disclosed by the manifest's converter-focused purpose. Accepting arbitrary remote URLs broadens the trust boundary and can lead to unintended fetching of third-party resources, privacy issues, or abuse of backend fetch behavior beyond what a user would expect from a simple upload converter.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The startup prompt 'Share your video files and I'll get started on AI format conversion. Or just tell me what you're thinking.' is broad enough to invite activation from generic conversation rather than a deliberate request for this specific skill. Overly generic invocation language increases the chance that users disclose files or intent to a remote service without realizing a third-party skill has been engaged.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example trigger phrase 'convert my video files' is generic and likely to overlap with ordinary user requests, making accidental routing more likely. In a skill that uploads media to a remote backend and creates sessions, ambiguous triggers raise the risk of unintended disclosure of files and metadata.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to establish a connection, obtain or mint tokens, create backend sessions, and process user media remotely, but it does not clearly warn users that uploaded files and associated metadata are sent to an external service. This is a meaningful transparency and privacy issue because users may believe they are using a local or narrowly scoped converter when their content is actually transmitted to a third-party cloud backend.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The session creation body hard-codes `"language":"en"` without reflecting user preference or obtaining consent. While not a severe security flaw by itself, it can mis-handle user content, route data under incorrect locale assumptions, and reduce transparency in a workflow already sending user media and instructions to a remote backend.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal