VideoLens.io

• Outcome: Pass
• Latest audit: Jun 10, 2026 at 1:41 PM UTC
• Version:
  1.0.1

Overview

VideoLens is a disclosed manual video-analysis wrapper that installs and runs an external VideoLens CLI, with no artifact evidence of hidden or malicious behavior.

Install this if you are comfortable providing an OpenAI API key and letting the skill clone and run the VideoLens CLI locally. Prefer the default OCC data paths, review the upstream repository if handling sensitive videos, and only set allow_credit_spend when you intentionally want model/API usage.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_command(command: list[str], *, env: dict[str, str] | None = None, cwd: Path | None = None, timeout: int = 300) -> dict[str, Any]:
    completed = subprocess.run(
        command,
        cwd=str(cwd) if cwd else None,
        env=env,

• Confidence: 91% confidence
• Finding: completed = subprocess.run( command, cwd=str(cwd) if cwd else None, env=env, capture_output=True, text=True, timeout=timeout, )

VirusTotal

65/65 vendors flagged this skill as clean.