Ai Video Generator Free Bangla

• Outcome: Review
• Latest audit: May 29, 2026 at 9:33 PM UTC
• Version:
  1.0.0

Overview

This appears to be a real cloud video-generation skill, but it can connect to a third-party service and route broad user input there too easily.

Install only if you are comfortable sending prompts, scripts, uploaded media, and render state to NemoVideo's cloud service. Avoid using it with private or sensitive content, and confirm intent before allowing setup, upload, SSE editing, or export requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation examples are broad enough that ordinary user phrases like "generate my text or script" or partial phrases such as "generate a video in Bangla with" may accidentally trigger the skill without clear user intent. In a skill that automatically connects to a remote API and may upload or process user content, ambiguous activation increases the risk of unintended data transmission and surprising behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The catch-all routing rule sends "Everything else" to SSE, meaning a very wide range of user input could be forwarded to the remote backend. Because SSE is the main path for edits and generation, this creates a prompt-routing vulnerability where unrelated or sensitive user text may be transmitted off-platform without sufficiently specific intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill does not prominently warn users that their prompts, uploaded media, and session state are sent to a third-party cloud service. This is dangerous because users may disclose sensitive scripts, media, or personal information under the assumption that processing is local or platform-native.

VirusTotal

66/66 vendors flagged this skill as clean.