Ai Video Editor Happy Birthday

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This birthday video skill does what it claims, but it automatically creates a third-party cloud session and can send prompts or uploaded media to NemoVideo with limited upfront user control.

Install only if you are comfortable with NemoVideo receiving your prompts, uploaded photos or clips, and render/session metadata. Avoid confidential or sensitive personal media, and prefer confirming before uploads or ambiguous edit requests are sent to the backend.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to automatically connect to a remote backend and, if no token is present, silently obtain an anonymous token and create a session without a clear user-facing consent step. This creates undisclosed network and authentication activity, and may cause users to upload data or establish third-party sessions without understanding that external services are being contacted and credentials/session state are being created.

VirusTotal

61/61 vendors flagged this skill as clean.