Image To Video Hd

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed cloud video-editing skill that sends selected media and prompts to NemoVideo for rendering, with no hidden code or destructive behavior found.

Install only if you are comfortable sending the photos, videos, audio files, URLs, and editing prompts you choose to NemoVideo's cloud service. Avoid sensitive personal or confidential media, protect any NEMO_TOKEN, and confirm ambiguous requests before allowing uploads, remote session creation, or exports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest and top-level description present the skill as a narrow photo-to-video converter, but the body documents broader capabilities including video/audio uploads, text overlays, state inspection, credits checks, export control, and iterative multimedia editing. This scope mismatch can mislead users and reviewers about what data and operations the skill can perform, increasing the chance of overbroad access and consent failures.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The suggested trigger phrases are short and generic, such as 'export 1080p MP4' and 'convert my still images', which could plausibly appear in unrelated conversations. Overly broad invocation language raises the risk that the skill activates unexpectedly and begins cloud-backed processing or session setup without sufficiently clear user intent.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The routing table sends 'Everything else' to the SSE editing pathway, creating a catch-all rule that is too permissive for a cloud-connected skill. Ambiguous routing can cause arbitrary user text to be forwarded to the backend, potentially transmitting unintended content or triggering edits/actions the user did not mean to request.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to connect automatically to a cloud backend, create tokens/sessions, and process user uploads remotely, but it does not clearly warn users up front that their files and prompts are transmitted off-device. This is a meaningful privacy and consent issue, especially because uploaded media may contain sensitive personal or commercial content.

VirusTotal

63/63 vendors flagged this skill as clean.