Free Video Generation Software

Security checks across malware telemetry and agentic risk

Overview

This video-generation skill does what it claims, but it automatically connects to NemoVideo and creates or uses a token/session before clearly asking the user.

Install only if you are comfortable with prompts, uploaded images/videos, URLs, and render state being sent to NemoVideo for cloud processing. Avoid sensitive or proprietary media unless you have reviewed the service's privacy and retention terms, and prefer a version that asks before first network connection or token/session creation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill sends user prompts, images, and generated render state to a third-party remote backend, but the user-facing description does not clearly warn about this data transfer before use. This can mislead users into sharing sensitive content under the assumption processing is local or opaque, increasing privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The authentication flow automatically acquires or uses a token from the environment and performs backend authentication without a clear warning to the user about credential usage and remote account/session creation. Even though the raw token is not shown, silent token use can surprise users, trigger unintended account activity, and blur consent boundaries around authentication and billing-related actions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal