Back to skill

Security audit

p-video

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Pruna video-generation helper that sends user-provided prompts and media to Pruna's API, with no hidden persistence or destructive behavior found.

Before installing, understand that generated-video requests may upload your prompts, images, and audio to Pruna, and that the skill may ask the agent to install additional Pruna helper skills from a live remote repository. Avoid using private or sensitive media unless you are comfortable sending it to that service, and prefer pinned or reviewed dependency versions in stricter environments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (27)

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding
The skill instructs agents to install and execute additional skills via `npx skills add ...` using floating package refs rather than immutable, cryptographically pinned artifacts. This creates a supply-chain risk: if the referenced package, tag, or transitive installer behavior changes, an agent may fetch and run unexpected code or altered prompts during execution.

External Transmission

Medium
Category
Data Exfiltration
Content
### Upload for image-to-video / frame anchors

```bash
curl -X POST "https://api.pruna.ai/v1/files" \
  -H "apikey: ${PRUNA_API_KEY}" \
  -F "content=@/path/to/first-frame.png"
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Upload for image-to-video / frame anchors

```bash
curl -X POST "https://api.pruna.ai/v1/files" \
  -H "apikey: ${PRUNA_API_KEY}" \
  -F "content=@/path/to/first-frame.png"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Upload for image-to-video / frame anchors

```bash
curl -X POST "https://api.pruna.ai/v1/files" \
  -H "apikey: ${PRUNA_API_KEY}" \
  -F "content=@/path/to/first-frame.png"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Upload for image-to-video / frame anchors

```bash
curl -X POST "https://api.pruna.ai/v1/files" \
  -H "apikey: ${PRUNA_API_KEY}" \
  -F "content=@/path/to/first-frame.png"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Upload for image-to-video / frame anchors

```bash
curl -X POST "https://api.pruna.ai/v1/files" \
  -H "apikey: ${PRUNA_API_KEY}" \
  -F "content=@/path/to/first-frame.png"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Upload for image-to-video / frame anchors

```bash
curl -X POST "https://api.pruna.ai/v1/files" \
  -H "apikey: ${PRUNA_API_KEY}" \
  -F "content=@/path/to/first-frame.png"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Upload for image-to-video / frame anchors

```bash
curl -X POST "https://api.pruna.ai/v1/files" \
  -H "apikey: ${PRUNA_API_KEY}" \
  -F "content=@/path/to/first-frame.png"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Upload for image-to-video / frame anchors

```bash
curl -X POST "https://api.pruna.ai/v1/files" \
  -H "apikey: ${PRUNA_API_KEY}" \
  -F "content=@/path/to/first-frame.png"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.