Security audit

LibTV Skill Pro

Security checks across malware telemetry and agentic risk

Overview

This is a coherent LibTV media-generation skill, but its optional HTML export can render untrusted session content unsafely in a browser.

Install only if you trust LibTV with the prompts, reference URLs, and media you choose to upload. Use a revocable API key, keep LIBTV_ACCESS_KEY out of logs, verify OPENAPI_IM_BASE/IM_BASE_URL are unset or trusted, use dry-run before paid generation, and avoid opening HTML exports from untrusted sessions until the export escaping issue is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The HTML export path embeds untrusted session message content directly into HTML after only replacing newlines with <br>, without escaping characters like <, >, &, quotes, or filtering dangerous tags/attributes. If a user or assistant message contains HTML or script payloads, opening the exported report in a browser can trigger stored XSS in the local report context, which is especially plausible because this skill processes arbitrary chat content and media URLs from generated sessions.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger description contains very broad everyday phrases such as '生成', '帮我做', and generic media-related terms, which can cause accidental invocation in unrelated conversations. In this skill, unintended activation is more dangerous because invocation may lead to network requests, cloud uploads, billing against the user's API key, and local file handling.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation explicitly instructs users to upload local image/video files and download outputs, but provides no warning that local content will be transferred to a third-party service or written back to disk. This can expose sensitive media or overwrite/store files in unexpected locations, especially if an agent performs these steps automatically.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill tells users to export an API key into an environment variable but does not warn that the key is sensitive, billable, and should not be logged, echoed, or shared with other tools. In an agent setting, poor credential-handling guidance increases the chance of accidental disclosure through command history, logs, screenshots, or debug output.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The example instructs users to upload a local image to LibTV OSS and later download the processed result, but it does not disclose that local content is being transmitted to and stored on a third-party remote service. This can expose sensitive personal, confidential, or regulated image data if users follow the example without understanding the data handling implications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The example instructs users to upload a local file from their home directory to a remote service and to download generated assets back to the local filesystem without any warning, consent prompt, or discussion of data handling. In an agent/skill context, this can cause unintended exfiltration of local content and unreviewed filesystem writes, especially if users copy-paste commands without understanding that personal or sensitive files are being transferred.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script sends user-supplied prompts and reference URLs to an external LibTV API via create_session(), but the CLI flow does not clearly warn users at execution time that their content will be transmitted off-host. This can expose sensitive prompts, internal image URLs, or private asset links to a third party, especially because the skill is explicitly built around media generation workflows that may involve proprietary or personal content.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This script transmits both a local file's full contents and the access credential to a remote service, but provides no explicit user-facing notice at the point of use that the file will leave the local machine or that the credential is being sent as part of the request. In a skill context, that creates a meaningful data exfiltration risk if users invoke it on sensitive files or misunderstand what endpoint is being contacted, especially because this tool is designed to upload media as part of an AI workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.