Maker Text Generator

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This skill is a cloud video text-overlay helper that sends selected media to NemoVideo as part of its stated purpose, with some scoping and transparency caveats.

Install only if you are comfortable sending chosen videos, prompts, and related media metadata to NemoVideo for cloud processing. Use a limited NEMO_TOKEN where possible, avoid sensitive or regulated footage, and ask the agent to confirm before uploads, URL ingestion, edits, or exports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The invocation phrases are very generic, such as 'generate my video clips' and 'export 1080p MP4', which can overlap with ordinary conversation. In an agent environment, broad triggers can cause accidental activation of this skill and unintended transmission of user content or initiation of remote API actions.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The routing rule sends 'Everything else' related to generate/edit/add BGM to SSE, which is an overly broad catch-all for a remote backend. This increases the chance that unrelated user instructions are interpreted as commands and forwarded externally, potentially exposing user data or causing unintended media operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to establish a backend connection and process uploaded videos on a remote API, but it does not clearly warn users that their media will be transmitted to a third-party service. For a video-processing skill handling potentially sensitive uploads, missing disclosure undermines informed consent and creates privacy and data-handling risk.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The session is created with language hard-coded to 'en' without checking user preference. While not a severe security issue, this can cause misprocessing of non-English content and inadvertent mishandling of user data or outputs, especially in multilingual contexts.

VirusTotal

66/66 vendors flagged this skill as clean.