Video Editing Ai Agent

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a coherent cloud video-editing skill, but users should understand that their videos and edit prompts go to NemoVideo’s remote service.

Install only if you are comfortable sending selected video files, edit instructions, and related session metadata to NemoVideo’s cloud backend. Avoid uploading sensitive, regulated, confidential, or private footage unless that external processing is acceptable to you.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The routing rule sends essentially all unmatched user input to the SSE editing action, which can cause unintended transmission of arbitrary prompts and context to the remote backend. In a skill that uploads and processes user media in the cloud, this broad fallback increases the chance of over-collection, accidental external sharing, and confusing or unsafe action execution when the user's request was not clearly about editing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill encourages users to upload raw video footage but does not clearly warn in the user-facing description that files and prompts are sent to a third-party cloud processing service. Because videos can contain sensitive visual, audio, location, or business information, the lack of upfront disclosure undermines informed consent and can lead to privacy and compliance issues.

VirusTotal

66/66 vendors flagged this skill as clean.