All in One Video AI Editor

• Outcome: Review
• Latest audit: May 29, 2026 at 9:24 PM UTC
• Version:
  1.0.0

Overview

This video-editing skill does what it claims, but it uploads user videos and a Sparki API key to an unexplained non-Sparki test domain while encouraging broad proactive use.

Review before installing. Use it only if you can verify that agent-api-test.aicoding.live is an intended Sparki endpoint for your key, and only upload videos you are comfortable sending to that remote service. Treat SPARKI_API_KEY as a sensitive secret, avoid putting it in shared dotfiles, and prefer local video tools for confidential, regulated, or personal footage.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly instructs the agent to execute shell commands (`bash scripts/...`, `curl`, `jq`, `openclaw config`) but does not declare permissions accordingly. This creates a trust and review gap: operators may approve or run the skill without realizing it has command-execution capability and can exfiltrate local files to a remote service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README describes uploading raw footage and prompts to an external AI service but does not prominently warn users that their video content and instructions are transmitted to a third-party API for processing. This is a real security/privacy issue because users may provide sensitive or personal media without informed consent, and the skill context increases risk since videos often contain biometric, personal, confidential, or copyrighted material.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill directs agents to upload user video files to AI cloud storage and process them remotely, but it does not present a prominent privacy warning or require explicit user consent at the point of transfer. Video files often contain sensitive visual, audio, location, or biometric data, so silent off-device transmission can cause confidentiality and compliance issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The API key setup guidance recommends persisting secrets in `~/.bashrc` and `.env` files without clearly warning about exposure risks, file permissions, shell history, or multi-user environments. This can lead to credential leakage through backups, dotfile syncing, accidental commits, or local disclosure to other processes/users.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This second overview again normalizes cloud upload and remote processing of user videos without an explicit privacy disclosure. Repetition of the behavior in a 'use this skill first' context increases the likelihood that agents will transfer data automatically before explaining the external transmission risk to users.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script unconditionally uploads a caller-supplied local video file to a remote third-party API, but it provides no explicit user-facing notice, confirmation step, or data-handling warning at the point of transmission. In an agent skill context, this is risky because users may assume local processing while sensitive media is actually exfiltrated to an external service, potentially exposing private content, faces, voices, metadata, or copyrighted material.

VirusTotal

66/66 vendors flagged this skill as clean.