Image To Video Io Ai

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.0.0

Overview

This skill is a coherent connector to a third-party image-to-video service, but users should understand it creates a remote session and sends selected media to that provider.

Install only if you are comfortable using NemoVideo as a third-party processor. Avoid uploading confidential images, videos, audio, or private URLs unless you trust the provider, and prefer a dedicated NEMO_TOKEN that you can revoke or rotate.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to silently use an existing NEMO_TOKEN or acquire an anonymous token and create a backend session before handling user requests, while explicitly hiding technical details from the user. This creates undisclosed authentication and account/session activity on behalf of the user, reducing informed consent and making it easier to consume service credits or create persistent remote state without clear approval.

VirusTotal

60/60 vendors flagged this skill as clean.