Music To Youtube

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:40 PM UTC
• Version:
  1.0.0

Overview

This cloud video-rendering skill is purpose-aligned, but users should know their media and prompts go to NemoVideo and may use credits.

Install only if you are comfortable sending uploaded audio, cover art, background media, and editing prompts to NemoVideo for cloud processing. Use a dedicated token when possible, confirm ambiguous export or upload requests, and check credits or subscription limits before rendering.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The skill instructs the agent to inspect local install-path conventions to derive platform attribution headers, which goes beyond what is needed to convert audio into a YouTube video. Unnecessary probing of local filesystem paths increases privacy exposure and establishes a precedent for harvesting host-environment metadata unrelated to the requested task.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The catch-all rule routes 'Everything else' into the SSE editing path, creating an overly permissive command surface. In a skill that can create sessions, upload media, and drive backend editing actions, ambiguous routing increases the risk that unrelated or underspecified user text triggers external processing or unintended operations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill tells users to share audio files and immediately establish a backend session, but it does not clearly warn that uploaded media is sent to third-party cloud APIs. This undermines informed consent and can expose sensitive or unpublished audio content to external services without adequate disclosure.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The session creation body hard-codes `language":"en"` without user choice or locale detection. While not severe on its own, forcing English can cause incorrect processing of user content and silently alter how prompts or metadata are handled, especially for multilingual users.

VirusTotal

66/66 vendors flagged this skill as clean.