Byted Mediakit Video

• Outcome: Pass
• Latest audit: Jul 9, 2026 · 6:13 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed MediaKit video-processing wrapper, but users should treat submitted media and API credentials as cloud-exposed data.

Install only if you trust the external MediaKit CLI and cloud service. Do not process confidential, regulated, internal-only, or personally sensitive audio/video unless you are authorized to send it to that service; prefer time-limited URLs and avoid putting secrets in video URLs, callback_args, or client_token values.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger condition is defined at the domain level ('当用户需要使用 video 域的 MediaKit CLI 能力时触发') and is broad enough to match many requests that merely mention video processing. In a shell-permitted skill, overbroad activation increases the chance the agent invokes external CLI operations and remote URL handling for requests that did not clearly require this specific tool, creating unnecessary data exposure and unintended command execution pathways.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill declares shell permission and supports processing user-supplied video URLs, but the description does not warn that using the skill may invoke local shell commands and send media or URLs to external services. This can mislead users and higher-level agents about trust boundaries, increasing the risk of unintentional data transmission, privacy issues, or execution of sensitive operations without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly states the capability is cloud-only, but it does not clearly warn users that submitted video URLs, and potentially the referenced media content and derived metadata, are transmitted to a remote service for processing. This can lead users to unknowingly send sensitive or regulated media to third-party infrastructure, creating privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly states the command is cloud-only and requires publicly accessible audio/video URLs, which means user-supplied media is transmitted to a remote service for processing. Because the skill does not warn about privacy, data handling, or sensitivity of uploaded content, users may unknowingly submit confidential or personal media to a third-party backend.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states the capability is cloud-only and exposes parameters such as `video_url` and `callback_args`, but it does not explicitly warn users that these values and the referenced media are transmitted to an external service. This can lead users to unintentionally send sensitive videos, signed URLs, internal endpoints, or callback metadata off-host, creating privacy, confidentiality, and metadata leakage risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to submit a video URL to a cloud-only service but does not warn that the referenced media will be processed remotely. This can lead users to unknowingly send sensitive or regulated video content to an external service, creating privacy, compliance, and data-governance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states the capability is cloud-only and requires a remote video URL, but it does not clearly warn users that submitted video content will be sent to an external cloud service for processing. This can cause inadvertent disclosure of sensitive or regulated video data, especially because video files often contain personal information, confidential scenes, or embedded text that users may assume is processed locally.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation states the capability is cloud-only and requires a remote video URL, but it does not warn users that the video will be sent to or processed by a remote service. This can cause users to upload sensitive or regulated video content without informed consent, creating privacy, confidentiality, and compliance risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly states the capability is cloud-only and accepts remote video URLs plus optional callback data, but it does not warn users that these inputs are transmitted to an external service. This can lead users to submit sensitive media, internal URLs, or metadata without informed consent, creating privacy, compliance, and data-handling risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to provide a publicly accessible video URL and notes support for cloud mode, but it does not clearly warn that video content may be transmitted to and processed by a remote service. This creates a real privacy and data-handling risk because users may submit sensitive videos without understanding exposure, retention, or third-party access implications.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that the input video URL must be publicly accessible, but it does not clearly warn users that this requires exposing their video to a third-party cloud service and potentially making the content reachable over the public internet. In a cloud-only video processing skill handling user media, this omission can lead to unintentional disclosure of sensitive or proprietary video content.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to submit a public video URL to an asynchronous remote media-processing service, but it does not explicitly disclose that the supplied URL and associated request metadata (such as callback arguments and tokens) will be transmitted to an external backend. This can cause users to unknowingly send sensitive or internally identifying URLs, query strings, or metadata off-host, creating privacy, confidentiality, and compliance risk. The skill context increases the concern because the capability is explicitly networked, supports cloud mode, and is intended to process user-supplied URLs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly states the capability is cloud-only and requires a publicly accessible HTTP/HTTPS video URL, which means user media must leave the local environment and be exposed to a remote service. Without a clear privacy, data handling, or security warning, users may unintentionally submit sensitive video content, creating confidentiality and compliance risks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly describes a cloud-only OCR operation on user-supplied video URLs but does not warn that the video content will be transmitted to and processed by a remote service. Because videos may contain sensitive visual data, embedded subtitles, personal information, or confidential material, users could unknowingly expose private content when invoking this skill.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.