Security audit

Pinterest Video Download

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Pinterest video downloader with expected local file writing and ffmpeg use, but users should be aware it can overwrite its chosen output file.

Install only if you are comfortable with the agent using ffmpeg to download media from Pinterest and save an MP4 locally. Use a trusted ffmpeg installation, keep outputs in the stated downloads folder, and do not reuse important filenames as the output path.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill states it will write files under the user's home workspace and may install dependencies, but it does not clearly warn the user about these system changes or require explicit consent. Silent local writes and package installation can modify the environment, consume storage, or introduce supply-chain risk if dependency installation pulls unreviewed packages.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script fetches remote media from a user-supplied URL and unconditionally passes -y to ffmpeg, which will overwrite any existing output file without confirmation. In this skill context, where URLs and output paths may be derived from user or workflow inputs, that increases the chance of accidental data loss and makes abuse easier if an attacker can influence the destination path.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.