imgnAI Katana API

• Outcome: Pass
• Latest audit: Jun 9, 2026 · 5:08 PM UTC
• Version: 1.0.3

Overview

This is a disclosed paid media and LLM API skill with expected credential use, remote data submission, and optional local ffmpeg processing; the notable risks are user-consent and setup hygiene rather than hidden or malicious behavior.

Install only if you are comfortable sending prompts, files, and media inputs to imgnAI Katana and using an API key that can spend credits. Keep the secrets file private, review the cost/recipient details before confirming requests, and do not let the agent run ffmpeg package-manager install commands unless you explicitly want to modify the host environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The workflow explicitly tells the agent to install ffmpeg if it is missing, including via privileged package-manager commands. That expands the skill from media post-processing into host modification and software installation, which is risky in an agent context because a simple content request could lead to unreviewed system changes or privilege escalation attempts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The image-editing triggers are ambiguous about scope and inputs, e.g. 'edit this image' and 'modify image', without requiring the presence of a concrete attachment or explicit source. In an agent setting, this can cause the skill to bind to unintended prior context or the wrong asset, leading to unauthorized processing or disclosure of user-provided images to the Katana service.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The image-editing triggers are ambiguous about scope and inputs, e.g. 'edit this image' and 'modify image', without requiring the presence of a concrete attachment or explicit source. In an agent setting, this can cause the skill to bind to unintended prior context or the wrong asset, leading to unauthorized processing or disclosure of user-provided images to the Katana service.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation text is very broad, triggering on common requests like edit, trim, crop, convert format, or otherwise post-process a generated video. In an agent system, such broad routing can cause this skill to activate in many unrelated or only loosely related contexts, increasing the chance that risky shell-oriented instructions are loaded and followed unnecessarily.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrase list is very broad ('edit, join, trim, crop, add text, add effects, convert format, or otherwise post-process'), so the agent may load this workflow for loosely related requests that merely mention these common terms. That can cause unintended tool routing into ffmpeg-based post-processing paths, increasing the chance of acting on the wrong user intent or exposing file-processing capabilities more often than necessary.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This workflow directs the agent to send user prompts and optional file URLs to a third-party remote API, but this section does not require an explicit user-facing disclosure or consent step before transmission. In a skill handling text, files, and privacy-sensitive 'private' modes, that omission can lead to unintentional disclosure of sensitive user data to an external service.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.