Sora Video Generation

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward helper for generating Sora videos through OpenAI, with expected API-key use, network calls, and local media output.

Install only if you are comfortable sending prompts, optional reference images, and related generation metadata to OpenAI and potentially incurring API costs. Prefer OPENAI_API_KEY over passing --api-key on the command line, and avoid using sensitive or unauthorized images.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation indicates use of environment variables and outbound network access, but no permissions are declared. This creates a transparency and governance gap: agents or reviewers may not realize the skill can read secrets such as OPENAI_API_KEY and transmit data externally, increasing the chance of unintended secret use or data exfiltration through normal operation or later script changes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal