Completely Free Video Generation

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed cloud video-generation connector, but users should know their prompts and chosen media are sent to NemoVideo for processing.

Install this only if you are comfortable sending prompts, selected images, audio, or videos to NemoVideo's cloud service. Avoid private or regulated media unless you have reviewed the provider's terms, keep NEMO_TOKEN private, and check credit/free-use limits before relying on it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to automatically obtain a token and connect to a remote backend, including sending user prompts and potentially uploaded media for cloud processing, without a clear up-front consent notice. This creates a privacy and data-handling risk because users may unknowingly transmit sensitive content to a third-party service.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Automatically detecting and transmitting the user's language during session creation without opt-in introduces unnecessary data collection and reduces user control over what metadata is shared. In isolation this is a limited issue, but it can contribute to privacy concerns when combined with automatic backend connection and content upload.

VirusTotal

66/66 vendors flagged this skill as clean.