Generator In Video

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a cloud video-processing skill that appears purpose-aligned, but users should know their prompts and selected media may be sent to NemoVideo for processing.

Install only if you are comfortable with NemoVideo receiving the media and prompts you choose to process. Do not upload confidential, private, or regulated videos, and keep the NEMO_TOKEN private.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The routing table explicitly sends 'Everything else' to the SSE/chat action, which means the skill can be invoked for nearly any user utterance once selected. In a skill that uploads media and sends prompts to a remote backend, this broad catch-all increases the chance of unintended activation, accidental data disclosure, and user confusion about where their content is being processed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill handles user-uploaded videos and text prompts by transmitting them to a third-party remote service, but the getting-started flow tells the agent to 'keep the technical details out of the chat.' That omission materially weakens informed consent because users may share sensitive footage, audio, or metadata without a clear warning that their data leaves the local environment and is processed server-side.

VirusTotal

65/65 vendors flagged this skill as clean.