FableForge AI Video Studio

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 1.0.1

Overview

This is mostly a coherent video-production skill, but it needs Review because it defaults to cloned-voice narration and includes unpinned setup downloads plus repository commit/push instructions.

Install only if you are comfortable with a skill that can set up local video tooling, download dependencies, use or create a cloned voice, fetch media, and alter a git repository. Before running it, require explicit approval for any voice-clone use, review downloaded files and dependency sources, inspect git diffs before commits, and do not allow git push unless you intentionally want to publish to that remote branch.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly directs the agent to prefer a user's voice-clone environment and run local voice-cloning scripts, introducing biometric-style synthesis capability that goes beyond ordinary TTS. This is dangerous because voice cloning can enable impersonation, privacy violations, and unauthorized use of a person's vocal identity, especially when the SOP makes it the default behavior rather than an opt-in action with consent checks.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The SOP includes `git add`, `git commit`, and `git push origin main`, which gives the skill repository publication capability unrelated to the core task of generating a video. This is risky because it can exfiltrate generated or local project content to a remote repository, create unintended persistence, and modify external systems without a narrowly scoped, explicit approval step.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a video-generation SOP, but it also instructs the agent to perform local environment bootstrapping, dependency acquisition, and toolchain installation/download. That expands the operational scope from content production into host modification and code execution preparation, which increases supply-chain and unauthorized system-change risk, especially if the referenced resource files are later altered or fetched from untrusted sources.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes a video-generation workflow, but the SOP later mandates publishing/marketing output and repository actions, including updating README and performing a local Git commit. Hidden side effects like content publication preparation and version-control mutation exceed the declared purpose and can cause unintended disclosure, persistence, or tampering with a user's repo.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Requiring a local Git commit is not necessary to generate a video and introduces a persistent write action to the user's repository. In an agent context, automatic commits can conceal or legitimize unintended file modifications, pollute history, and create a path for accidental inclusion of sensitive assets or generated promotional content.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The initialization commands reference `.agents/skills/fableforge/...` while the manifested skill is `ai-video-studio`, creating a path mismatch that can cause the agent to copy resources from the wrong skill or from an attacker-controlled local directory with that name. In a skill that performs automated setup, cross-skill path confusion is dangerous because it can silently import unintended templates or executable scaffolding into the workspace.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The stage explicitly mandates use of a local user voice-clone environment by default, which involves biometric voice data and can trigger sensitive processing without a clear consent gate or privacy warning. In an agent workflow, defaulting to cloned-voice synthesis increases the risk of unauthorized impersonation, privacy violations, and misuse of stored voice models.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: These instructions direct the agent to discover, download, and process third-party media using browser/manual search plus shell tools, which expands the attack surface to untrusted remote content and external infrastructure. The workflow also normalizes automated retrieval and processing without strong origin validation, file-type validation, or sandboxing controls.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instruction to always use the user's voice clone if present lacks any warning or consent flow around biometric and privacy implications. In context, this normalizes sensitive voice replication as a default production step, increasing the risk of unauthorized cloning, misuse of personal data, and deceptive media generation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs automatic `curl`, `unzip`, `mkdir`, `mv`, `chmod`, and `rm` operations that download binaries from the network and modify the local workspace without an explicit user warning or confirmation. This creates supply-chain and integrity risks because remote binaries are fetched and made executable immediately, and users are not clearly told that files will be added, moved, and permissions changed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions create a Python virtual environment and install packages (`voxcpm`, `soundfile`, `torch`, `numpy`) without prior notice about package installation, disk usage, or environment changes. In an agent context, unattended dependency installation can expose users to malicious or tampered packages, version drift, and unexpected workspace state changes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill makes voice-clone usage the default path without presenting an explicit user-facing warning or consent checkpoint for biometric processing. Because voiceprints are sensitive identifiers, this omission makes accidental or unauthorized cloning materially more dangerous in a content-production skill.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.