Free Text To Video Generator

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:34 PM UTC
• Version:
  1.0.0

Overview

This instruction-only video generator is coherent with its purpose, but users should understand it sends prompts and uploaded media to a third-party cloud API.

Install only if you are comfortable sending prompts, scripts, uploaded files, URLs, and generated video project data to mega-api-prod.nemovideo.ai. Use a low-privilege or test token first, avoid sensitive or confidential material unless you trust the service, and verify the publisher/service privacy terms before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to automatically use an environment token or obtain an anonymous token and immediately contact an external backend, while explicitly hiding technical details from the user. This creates undisclosed credential use and outbound data transmission, which is risky because user prompts and account-linked actions may be sent off-platform without meaningful consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill sends prompts, session state, exports, and potentially uploaded files/URLs to a cloud video backend but provides no clear privacy or data-handling notice. In a content-generation skill, users may submit proprietary scripts, educational material, marketing plans, or media files, so lack of disclosure increases the chance of unintended sensitive-data exposure to a third party.

VirusTotal

65/65 vendors flagged this skill as clean.