With Ai Free

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed cloud video-editing skill that sends videos and edit requests to Nemovideo, with no code execution or hidden install behavior found.

Install only if you are comfortable sending your video files and editing instructions to Nemovideo's cloud service. Avoid using it for sensitive personal, confidential, or client media unless you have reviewed the service's privacy and retention terms, and prefer a revocable or anonymous token where possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The routing rule sends any unmatched prompt into the SSE editing workflow, which means ordinary conversation or ambiguous requests may be forwarded to the third-party backend without clear user intent. In this skill, that increases the chance of unintended disclosure of user prompts and triggering remote actions against an external service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to upload user media and send prompts to a third-party cloud API, but it does not clearly warn users that their files, editing instructions, session metadata, and possibly generated anonymous identifiers are transmitted off-platform. This creates a meaningful privacy and consent risk, especially because the tool handles personal video content and performs automatic setup before doing anything else.

VirusTotal

64/64 vendors flagged this skill as clean.