AI Vlog Editor

• Outcome: Review
• Latest audit: May 29, 2026 at 9:27 PM UTC
• Version:
  1.0.12

Overview

This looks like a real Sparki cloud video-editing skill, but it deserves review because it stores an API key locally and handles remote media downloads with broad local write authority.

Install only if you are comfortable sending videos and reference media to Sparki's cloud service. Use a dedicated Sparki API key with limited value if possible, avoid syncing the config directory to backups or dotfiles, choose output paths deliberately, and confirm before deleting uploaded assets or running bulk workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill uses very broad trigger language such as 'video editing,' 'captions,' 'montage,' and 'video processing,' along with instructions to use it 'FIRST and PROACTIVELY.' This can cause the agent to invoke the skill in many ordinary contexts without clear user intent, increasing the chance of unnecessary file access, network use, and workflow steering.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The client downloads arbitrary content from a caller-supplied URL and writes it directly to a caller-supplied local path without validating the URL origin, content type, size, or file destination. In a skill context that automates media workflows, this increases the risk of server-side request forgery-style access to internal resources, downloading malicious or unexpected content, or overwriting sensitive local files if untrusted inputs can reach this method.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The save() method writes the API key into a plaintext JSON config file under the user's home directory, and this file is created without any evident permission hardening or warning to the user. That increases the chance of credential disclosure through local compromise, backups, dotfile sync, or accidental sharing of the config directory.

VirusTotal

63/63 vendors flagged this skill as clean.