Editor Pkg

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a coherent cloud video-editing skill, but users should know their media and prompts go to NemoVideo's API.

Install only if you are comfortable sending video, audio, images, URLs, editing prompts, and session metadata to NemoVideo's cloud service. Use explicit video-editing requests, avoid sensitive footage unless you trust the provider's retention and deletion practices, and prefer supplying your own managed NEMO_TOKEN if available.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill automatically provisions anonymous tokens and creates remote sessions without a clear, upfront consent boundary, enabling transmission of user prompts and media to a third-party cloud service. Even if needed for functionality, credential/session bootstrapping increases data-handling sensitivity and can surprise users who expect local-only editing or explicit opt-in before account/session creation.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The suggested trigger phrase is broad enough to activate the skill during ordinary conversation, increasing the chance of unintended routing to a cloud workflow. In this skill’s context, accidental activation is more dangerous because the first step is automatic external setup and potential token/session creation.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The catch-all routing rule sends essentially any non-matching request to the SSE backend, which is overly permissive and can cause unrelated user text to be forwarded to a third-party service. Because the backend may interpret free-form text as editing commands, this broad activation increases privacy and unintended-action risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill does not clearly warn users up front that their media files and prompts are uploaded to and processed by a cloud API. For a media-editing skill handling potentially sensitive recordings, this lack of disclosure materially increases privacy and consent risk, especially when setup is automatic on first interaction.

VirusTotal

66/66 vendors flagged this skill as clean.