Generator To Generator

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This video-processing skill appears purpose-aligned, but it under-discloses cloud handling of user media and can start remote processing from broad prompts.

Install only if you are comfortable sending the videos you provide, related prompts, and session metadata to NemoVideo's remote service. Avoid sensitive or confidential footage unless you trust that provider, and look for explicit confirmation before upload/export plus clear status, cancellation, and retention behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill invites activation from very generic phrases like 'convert my AI-generated video' or 'take this AI-generated video and re-generate,' which can overlap with normal conversation and unrelated media-editing requests. Because the skill can initiate remote setup and send user media to a cloud backend, accidental invocation can lead to unintended upload or processing of user content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill prominently encourages users to 'drop your AI-generated video' and states that it will handle processing on cloud GPUs, but it does not clearly warn up front that user media will be uploaded to a third-party remote backend. This creates a privacy and data-handling risk because users may disclose sensitive media without informed consent about where processing occurs.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The file notes internally that render jobs may be orphaned if the tab closes, but this persistence risk is not clearly surfaced to the user as a warning before export. Users may assume closing the client cancels processing, when in fact remote jobs and associated media may continue to exist or consume credits after disconnect.

VirusTotal

66/66 vendors flagged this skill as clean.