Security audit

URL to Video Generator

Security checks across malware telemetry and agentic risk

Overview

This skill matches its stated website-to-video purpose, but users should expect it to fetch websites, install video-rendering packages, and download background music.

Install only if you are comfortable with a skill that fetches the target website, creates a local Remotion project, installs npm dependencies, downloads a background music file, and renders video locally. Use public intended URLs, avoid private/internal addresses, review generated files before running npm scripts, and provide a simple alphanumeric brand name.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The description includes broad trigger phrases like "promo video" and general website-to-video requests, which can cause the skill to activate in contexts where the user did not intend scraping, downloading, or code execution. Over-broad invocation increases the risk of accidental tool use and unreviewed external access.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The "When to Use" section repeats vague activation guidance without clear scope limits, making unintended invocation more likely. In this skill, accidental invocation is more dangerous because the workflow proceeds into network fetching, scraping, downloads, and shell commands.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs scraping website content and extracting site data without notifying the user that it will access third-party sites or process external content. This is risky because users may unknowingly cause outbound requests to arbitrary domains, with possible privacy, policy, or legal implications depending on the target site.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The skill silently downloads third-party audio from Pixabay, which is external network activity not disclosed to the user. While lower risk than arbitrary scraping, it still introduces unexpected outbound traffic, dependency on remote content, and potential licensing or supply-chain concerns.

Natural-Language Policy Violations

High

Confidence: 91% confidence
Finding: Mandating Chinese narration without user choice is an unjustified output restriction that can produce unwanted or misleading results for users expecting another language. This is primarily a product safety and consent issue rather than a direct security compromise, but it can still cause misuse or surprise in automated workflows.

Natural-Language Policy Violations

High

Confidence: 94% confidence
Finding: The TTS step forces Chinese narration for all segments without opt-in, hard-coding a locale choice into generated output. In context, this is less dangerous than code-execution issues, but it remains a true policy and user-intent problem because it overrides likely user expectations.

Natural-Language Policy Violations

High

Confidence: 95% confidence
Finding: The key constraints section enforces Chinese narration globally, turning an unnecessary default into a mandatory behavior. This entrenches the unjustified restriction across the whole skill and makes accidental misuse more likely in non-Chinese contexts.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The script performs an outbound request to a user-supplied URL with minimal validation or operator warning, which can enable server-side request forgery behavior when run in a privileged environment. In this skill context, converting arbitrary websites into videos naturally invites fetching attacker-controlled URLs, making access to internal services, cloud metadata endpoints, or other restricted network locations more plausible.

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.