Video Online Free

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:40 PM UTC
• Version:
  1.0.0

Overview

This is a cloud video-editing skill that clearly depends on uploading media to a remote service, but its trigger and routing language should be tightened before using it with sensitive videos.

Install only if you are comfortable sending your videos, source URLs, editing prompts, and related session data to NemoVideo's cloud backend. Avoid sensitive or private media unless you trust that service's privacy, retention, and deletion practices, and prefer explicit video-editing requests rather than ambiguous prompts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The onboarding and invocation examples are broad enough that ordinary conversation like 'get started' or generic editing requests could unintentionally trigger the skill. Because this skill uploads media and sends instructions to a remote backend, accidental activation can lead to unintended transmission of user content and creation of remote sessions without clear user intent.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The catch-all rule routing 'Everything else' to SSE editing actions removes meaningful scope boundaries, so unrelated or ambiguous user text could be sent directly to the backend as editing instructions. In this skill's context, that is more dangerous because the backend performs stateful cloud operations and may process uploaded media, creating a higher risk of unintended external data disclosure and unexpected actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill does mention remote processing later, but the main user-facing description and workflow do not prominently warn that uploaded videos and editing instructions are sent to a cloud backend. This weak disclosure is risky because users may share sensitive media under the assumption that editing is local or confined to the client, leading to privacy and consent issues.

VirusTotal

64/64 vendors flagged this skill as clean.