Free Video Generation Online

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a coherent cloud video-generation skill, but users should know their prompts and uploaded media are sent to NemoVideo for processing.

Install only if you are comfortable sending selected prompts, images, videos, audio, URLs, and generated timeline state to nemovideo.ai. Avoid confidential or regulated media unless you trust that provider's privacy, retention, and billing terms, and keep NEMO_TOKEN out of chats, logs, and screenshots.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The routing table sends all unmatched requests to the SSE generation/edit path, which can cause accidental invocation of cloud-side actions for vague or unrelated user prompts. In a skill that uploads user content and issues backend operations, an overbroad catch-all increases the chance of unintended data transfer or costly/irreversible actions without sufficiently clear user intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill encourages users to provide text and images but does not clearly warn that prompts, files, and timeline state are sent to a third-party cloud backend. This creates a privacy and consent risk because users may unknowingly transmit sensitive media or business content off-device.

VirusTotal

66/66 vendors flagged this skill as clean.