Ai Video Editor Hiring

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:38 PM UTC
• Version:
  1.0.0

Overview

This is a cloud video-editing skill whose network use, token handling, and media upload behavior match its stated purpose, but users should understand that selected media and edit prompts leave the local environment.

Install only if you are comfortable sending the media files you choose, plus related editing instructions, to NemoVideo's cloud service. Avoid highly sensitive footage unless you trust that service's privacy and retention practices, and prefer a dedicated or short-lived NEMO_TOKEN.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The getting-started prompt invites users to 'share your raw video footage' or vaguely describe what they want, which is broad enough to match common conversational requests outside a tightly scoped invocation. In an agent ecosystem, this can cause accidental skill activation and unintended routing of user content into a third-party video backend, especially because the skill is designed to upload user media to cloud services.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The example trigger phrases are extremely generic, especially 'edit my raw video footage' and the incomplete phrase 'trim the pauses, add transitions, and', which could overlap with ordinary user instructions in unrelated contexts. This increases the chance of unintended activation and may expose private media or user intent to an external cloud processor without sufficiently explicit consent.

Vague Triggers

High

• Confidence: 99% confidence
• Finding: The routing table contains an 'Everything else' catch-all that sends any unmatched request to the SSE editing path. That is dangerous because it effectively makes the skill promiscuous: unrelated or ambiguous user input may be forwarded to the remote backend, creating risks of accidental invocation, unintended data disclosure, and unexpected billable actions or session manipulation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explains cloud processing behavior but does not present a prominent user warning that uploaded videos and associated instructions are sent to a third-party cloud backend. Given that users may upload raw footage containing sensitive personal, business, or biometric data, the absence of an explicit privacy and data-transfer warning materially increases the risk of uninformed disclosure.

VirusTotal

64/64 vendors flagged this skill as clean.