Free Unlimited Ai Video Generator

• Outcome: Review
• Latest audit: May 29, 2026 at 9:35 PM UTC
• Version:
  1.0.0

Overview

This looks like a real cloud video-generation skill, but it broadly sends user prompts and uploaded files to NemoVideo with unclear consent boundaries.

Review before installing. Use it only for video/text-generation work you are comfortable sending to NemoVideo, avoid sensitive documents or private media, and confirm when the agent is about to upload files or forward an ambiguous prompt.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The routing rule sends essentially all unmatched user input to the generation/SSE action, which creates an overly broad activation surface. In practice, ordinary conversation or unrelated requests could be forwarded to a third-party video API, causing unintended prompt transmission, unexpected external actions, and possible privacy issues.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The phrase "Or just tell me what you're thinking" is vague everyday-language guidance that encourages invocation from ambiguous, non-task-specific user input. This increases the chance the skill captures general conversation and forwards it to the external service without clear user intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill asks users to share prompts and upload media, but it does not prominently disclose that these inputs are sent to a third-party cloud API for processing. This is a privacy and consent problem, especially because uploaded files may contain sensitive content and the backend stores sessions, render jobs, and downloadable outputs.

VirusTotal

64/64 vendors flagged this skill as clean.