avatar-multi-scene

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 2:21 PM UTC
• Version: 1.0.11

Overview

This skill is a disclosed Pruna video-production workflow with approval gates, but users should note the external API use, media uploads, package-install commands, and ffmpeg overwrite examples.

Install this only if you intend to use Pruna services for avatar/video generation and are comfortable providing PRUNA_API_KEY, uploading selected media references, installing related skills, and letting ffmpeg create or overwrite local render files. Review scripts, cast, media rights, and output paths before approving generation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Memory Manipulation

High

• Category: Memory Poisoning

Content

**Motion-template `voice_prompt` (do):**

```text
Clear conversational delivery throughout — speaking directly to camera. Natural pacing with real pauses.
```

When motion-source prompts change, delete cached motion-source stills before regen. See [animate-beats.md](./animate-beats.md).

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx skills add ...` without pinning the `skills` CLI itself to a specific version. `npx` resolves and executes the latest matching package at runtime, so a compromised or breaking upstream release could execute unexpected code on the user's machine. Because this is an installation/execution path in documentation, the risk is real even though it is not overtly malicious.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The cast ledger example specifies `voice_language` as `English (US)`, which can steer users toward a fixed locale by default. Because this template is intended for repeated reuse, a hard-coded language/locale example may impose a language preference without explicit opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The character sheet field `Pruna voice: [e.g. Puck (Male)] / [English (US)]` presents a specific locale as the standard example. This can create an implicit policy violation by encouraging English (US) output even when the user has not selected a language.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The manifest JSON example sets `voice_language` to `English (US)` as part of the reusable scene package. In a template file, this may normalize a specific locale choice without user opt-in or a documented regional justification.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This markdown file includes an ffmpeg command using the `-y` flag, which forces overwriting the output file without prompting. The surrounding documentation presents the command as a straightforward step and does not warn users that an existing `scene_compare.mp4` may be replaced.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.