Ai Image To Video Apk

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This looks like a real media-generation skill, but it is too easy to trigger and can automatically send prompts or files to NemoVideo without a clear consent step.

Review before installing. Use it only if you intend to send prompts and media files to nemovideo.ai for processing, and avoid sensitive or private content unless you trust that service. Prefer a version that asks for explicit confirmation before setup, upload, SSE processing, or export.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The example invocations are broad and generic enough that ordinary phrases like "export 1080p MP4" or "convert my still images" could trigger this skill unexpectedly. In a skill that automatically connects to an external API and may upload user content, overly permissive activation increases the chance of unintended data transmission and user confusion about which tool is operating.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The routing table explicitly sends "Everything else" to the SSE action, creating an almost universal fallback. Because SSE forwards arbitrary user text to a third-party backend, this catch-all greatly expands the chance of accidental activation, unintended prompt forwarding, and external processing without clear user intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to automatically obtain an anonymous token and create a remote session on first interaction, but it does not require a clear user-facing disclosure that prompts and files will be sent to an external service. This is dangerous because users may believe they are interacting locally while their content, including uploaded images, is transmitted off-platform to a third party.

VirusTotal

66/66 vendors flagged this skill as clean.