AI Video Editor

• Outcome: Pass
• Latest audit: May 28, 2026 at 8:53 AM UTC
• Version:
  1.0.12

Overview

The skill appears to be a disclosed Sparki video-editing integration that uploads user-selected MP4 files for processing and downloads results, with no artifact-backed evidence of deception, persistence, credential theft, or unrelated data access.

Before installing, confirm you are comfortable uploading selected MP4 files to Sparki's remote service and ensure the skill is only used on videos you are allowed to share externally. The manifest should ideally declare its network, file, environment, and execution needs more explicitly, but the reviewed evidence does not support a Review or malicious classification.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises and relies on sensitive capabilities including environment access, file read/write, network access, and shell/Python execution, yet the manifest does not declare explicit permissions. This weakens review and user consent because the effective capability surface is broader than what a consumer may expect from the permission model.

VirusTotal

64/64 vendors flagged this skill as clean.