Free Copywriter Video

• Outcome: Pass
• Latest audit: May 28, 2026, 1:42 PM
• Version:
  1.0.0

Overview

This skill is a disclosed cloud video-generation integration, but users should know prompts and uploaded files are sent to nemovideo.ai for processing.

Install only if you are comfortable sending prompts, documents, media, and generated video state to nemovideo.ai. Avoid uploading confidential client, personal, regulated, or proprietary material unless you trust the provider and its terms; use your own NEMO_TOKEN if available and expect session/config data to be associated with this service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The routing table sends 'Everything else' into the SSE generation flow, which means ambiguous or unrelated user requests may still be forwarded to the remote backend. In a skill that uploads prompts and potentially file-derived content to a cloud service, this broad fallback increases the chance of unintended data transmission and unexpected actions rather than enforcing least-privilege intent matching.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to connect to external APIs and obtain tokens before doing anything else, but it does not present a clear privacy notice that user text, prompts, and uploaded files will be transmitted to a third-party cloud service. This is dangerous because users may share sensitive documents under the assumption processing is local or agent-contained, leading to unconsented disclosure of potentially confidential data.

VirusTotal

No VirusTotal findings