Free Text To Video Best

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:38 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed cloud text-to-video connector, but users should avoid sending sensitive content to the remote video service.

Install only if you are comfortable sending prompts, documents, and media to NemoVideo's remote API. Do not upload confidential, regulated, or proprietary material unless that service is approved for it, and prefer a limited or anonymous token for testing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The catch-all routing rule sends essentially any unmatched request into the SSE/edit pipeline, which increases the chance of unintended activation and remote actions against the backend. In a skill that can upload content, query state, and initiate rendering sessions, overly broad triggering can cause accidental data submission or actions the user did not clearly authorize.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The routing description relies on vague keyword and intent classification without precise constraints, making it easy for unrelated prompts to be interpreted as actionable backend commands. Because the skill automatically connects to remote APIs and maintains a session, ambiguous routing can result in unintended processing of user input and unnecessary exposure of uploaded content to third-party services.

VirusTotal

66/66 vendors flagged this skill as clean.