Ai Generator Video Maker Free

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a cloud video-generation skill that uses NemoVideo APIs as advertised, with no local executable installer, but users should understand prompts and files may be sent to that service.

Install only if you are comfortable sending prompts and uploaded images, videos, audio, or text to NemoVideo's cloud service for processing. Avoid sensitive, confidential, or regulated content unless you have reviewed that service's privacy and retention terms, and confirm which NEMO_TOKEN or account will be used before generating or exporting.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad enough that ordinary conversation such as 'generate', 'export', or sending a file could activate the skill and route user content into backend actions. In this skill, activation leads to network requests, token acquisition, session creation, and remote processing, so accidental invocation can cause unintended data transmission and external side effects.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to upload images, text, and other media to a remote backend but does not clearly disclose that user content will be transmitted off-platform. Because the skill handles potentially sensitive media files and prompts, lack of disclosure undermines informed consent and increases privacy and data handling risk.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The metadata declares use of `NEMO_TOKEN` from the environment and local config paths, but the description does not warn users that existing credentials may be consumed automatically. This can surprise users, cause unintended account linkage or quota consumption, and obscure which identity is being used against the remote service.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The session creation request hardcodes `"language":"en"` without checking the user's preferred language or obtaining consent. This is primarily a trust, UX, and data handling issue because user input may be sent to the backend under the wrong language context, potentially degrading output or misprocessing non-English content.

VirusTotal

66/66 vendors flagged this skill as clean.