article-to-video

• Outcome: Pass
• Latest audit: Aug 6, 2026 · 9:59 PM UTC
• Version: 1.0.0

Overview

This is a coherent article-to-video skill, but users should understand that document text may be sent to cloud TTS or image-generation services and local media assets may be cached or changed.

Install only if you are comfortable with supplied document text being converted through cloud TTS by default and, in AI image mode, being summarized into prompts for an external image tool. Avoid sensitive or proprietary documents unless you have approval, periodically clear generated cache/output files, and treat the BGM remove command as a permanent local delete. Maintainers should add an explicit permissions/privacy section and raise dependency minimums to patched versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes capabilities to read and write files, invoke shell commands, and use networked services, but it does not declare any permissions or boundaries for those operations. This creates a transparency and governance gap: an agent may execute powerful actions without explicit consent controls, increasing the risk of unintended file access, command execution, or external data transmission.

Description-Behavior Mismatch

Medium

• Confidence: 78% confidence
• Finding: The file implements a standalone administrative media-management utility that exceeds the stated article-to-video conversion scope. Capability creep matters because upload/remove operations enlarge the attack surface and may allow an agent or operator to manipulate local assets unrelated to the advertised skill behavior.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The upload and remove functions provide local file-management capabilities over asset libraries, which are sensitive administrative actions not justified by the user-facing skill description. In an agent context, such hidden maintenance features can be invoked unexpectedly and can alter persistent local state.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation text is broad enough that the skill could be triggered for loosely related requests involving documents, articles, or text-to-video conversion without clear scoping. Over-broad activation can cause the agent to process sensitive user files or initiate costly file/network/shell workflows when the user did not clearly request this specific pipeline.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The 'When to Use' conditions are ambiguous and based on broad phrases rather than strict prerequisites, which increases the chance of accidental activation. In this skill, accidental activation is more dangerous because the workflow includes document parsing, file generation, shell-based media assembly, and optional external service use.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The skill defaults to Chinese TTS voices and Chinese subtitle/font assumptions without explicit user opt-in or locale detection. While not a classic security flaw, this can lead to unintended processing choices, poor output integrity, and accidental disclosure to external TTS providers if the user did not consent to those language-specific defaults.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: remove_bgm_file deletes files immediately once the path is constructed and existence checks pass, with no confirmation, dry-run, or recovery mechanism. In agentic or scripted use, a mistaken or malicious invocation can permanently remove media assets and disrupt future video generation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The fallback to gTTS transmits narration text to Google's service without any visible consent, warning, or privacy gate. Because this skill converts user-supplied documents into narration, the text may contain sensitive or proprietary content that is silently exfiltrated to a third party when the primary engine fails.

Known Vulnerable Dependency: markdown==3.5 — 2 advisory(ies): CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: markdown==3.5

Known Vulnerable Dependency: Pillow==10.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +7 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: Pillow==10.0.0

Known Vulnerable Dependency: pygments==2.16.0 — 2 advisory(ies): CVE-2026-4539 (Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Reg); CVE-2026-4539 (Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Reg)

Medium

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: pygments==2.16.0

Known Vulnerable Dependency: click==8.1.0 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)

High

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: click==8.1.0

Known Vulnerable Dependency: requests==2.31.0 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: requests==2.31.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.