Ai Viral Team Video Generation

Security checks across malware telemetry and agentic risk

Overview

This is a coherent video-generation instruction skill that discloses Vidu API use and local video stitching, with no hidden code, persistence, or destructive behavior found.

Install this only if you are comfortable using a Vidu API token and sending generation prompts, storyboards, and possibly media references to Vidu. Use a scoped token if possible, monitor paid usage, keep work inside intended project folders for FFmpeg processing, and review the referenced script-writing and quality-check skills before relying on the full workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The manifest entry uses a broad activation path with generic role/task terms rather than a narrowly scoped trigger, which can cause the skill to activate in unintended contexts. In an agent system, overbroad routing increases the chance that unrelated user requests or sensitive content are sent into this skill's workflow, including external generation and editing steps.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly references an external endpoint and token-based access but does not warn users that prompts, scripts, or media may be transmitted to a third-party service. This creates a privacy and data-governance risk because sensitive creative content or personal data could be sent off-platform without informed consent or handling guidance.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal