Video Editor Apk

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This is a cloud video-editing skill, but it may automatically create a NemoVideo session and send prompts or uploaded media to the backend with limited user notice.

Install only if you are comfortable with prompts and media being processed by NemoVideo's cloud service. Avoid sending private, client, unreleased, or regulated video/audio/documents unless you have approval, and prefer an explicit token/account setup where you understand retention, credits, and export terms.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The skill advertises highly generic trigger phrases like "edit my video clips" and similar broad language that could cause activation on ordinary user requests without clear intent to invoke this specific third-party service. In this skill, unexpected activation is more concerning because invocation can lead directly to automatic backend connection and token acquisition, causing unanticipated network activity and data handling.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The catch-all rule routing "Everything else" to the SSE action creates an ambiguous trigger surface where many unrelated editing-style prompts could be sent to the remote backend. Because SSE is the primary cloud-processing path, this broad routing increases the chance of accidental exfiltration of user prompts or attached media to a third-party service without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically connect to the backend and even obtain an anonymous token on first use, but only says to keep setup communication brief and not expose raw responses. That means users may not receive a meaningful notice that a remote service is being contacted, a token is being created, and future content may be associated with a cloud session, which undermines informed consent and privacy expectations.

VirusTotal

66/66 vendors flagged this skill as clean.