Free Editor Maker

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This cloud video-editing skill is mostly aligned with its purpose, but it can automatically create a remote session and send media or broad prompts to a third-party service without enough upfront user control.

Review before installing. Use this only for videos, URLs, and prompts you are comfortable sending to Nemovideo's remote service, and avoid confidential, private, or regulated media unless you have separate assurance about retention and deletion. Prefer explicit confirmation before token creation, upload, SSE editing, URL fetches, or export.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly supports uploading media by arbitrary URL, which expands data ingress beyond user-local files and can be abused to make the backend retrieve attacker-chosen remote content. That increases exposure to SSRF-style fetch risks, ingestion of unexpected/private resources, and privacy issues if users provide sensitive internal or temporary URLs.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The catch-all routing rule sends nearly any unmatched prompt into the SSE editing workflow, creating over-broad prompt-to-action behavior. This can cause accidental transmission of unrelated user text to the remote backend, increase privacy leakage, and make the skill perform networked actions when the user's intent was ambiguous or out of scope.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill asks users to upload media and provide prompts but does not prominently warn that both are transmitted to a third-party remote backend for processing. In a media-editing context this is significant because uploaded videos often contain sensitive visual, audio, or personal information, and users may reasonably assume local handling unless clearly told otherwise.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The skill notes that closing the tab can orphan jobs and that the session token carries render job IDs, but it does not present this as a user-facing warning before use. This creates a transparency and privacy issue because users are not clearly informed that unfinished processing and associated state may persist remotely after they leave.

VirusTotal

65/65 vendors flagged this skill as clean.