Video Editing Ideas Ai

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed cloud video-editing integration, but users should understand that videos, prompts, and optional media URLs are sent to NemoVideo for processing.

Install only if you are comfortable sharing selected video files, prompts, and media URLs with nemovideo.ai. Avoid confidential footage, keep NEMO_TOKEN private, and ask the agent to confirm before uploading, fetching a URL, or exporting if you want tighter control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest markets the skill as generating editing ideas from raw footage, but the body documents materially broader behavior: uploading media to a cloud backend, running a render pipeline, and returning downloadable 1080p MP4 outputs. This scope mismatch can mislead users and host platforms about what data leaves the device and what actions the skill performs, undermining informed consent and security review.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Allowing URL-based media ingestion expands the trust boundary from user-supplied local footage to arbitrary remote resources, which is not necessary for the advertised purpose. This can enable unintended fetching of third-party or internal URLs by the backend, creating privacy, compliance, and potential SSRF-style risk depending on backend behavior.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation examples are broad and the routing rule sends 'everything else' into the main SSE action, increasing the chance the skill activates on ambiguous prompts. In a skill that uploads media, creates sessions, and communicates with a cloud service, unintended activation can cause unexpected network actions or processing without sufficiently clear user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description and getting-started flow do not clearly warn users that their media is uploaded to a cloud backend for processing. Because the skill handles potentially sensitive raw footage, insufficient disclosure materially increases privacy risk and reduces the user's ability to make an informed decision before sharing data.

VirusTotal

66/66 vendors flagged this skill as clean.