Video Generation Ai Tools

• Outcome: Review
• Latest audit: May 29, 2026, 9:32 PM
• Version:
  1.0.0

Overview

This skill is a cloud video tool, but it can automatically create a remote session and route broad requests to a third-party backend before user intent is clearly confirmed.

Install only if you are comfortable sending prompts, uploaded images, videos, and session data to nemovideo.ai for cloud processing. Use it with explicit video-generation requests, avoid sensitive or regulated media unless the provider's privacy and retention terms are acceptable, and prefer a confirmation step before connection, upload, generation, or export.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The example trigger phrase "generate my text or images" is broad and unnatural enough to create ambiguous activation boundaries for the skill. Over-broad invocation guidance increases the chance the skill is triggered during ordinary conversation, causing unintended backend use and data transmission to a remote service.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The example phrase "generate a 30-second promotional video from" is incomplete and too vague to safely distinguish this skill from general content-generation requests. Ambiguous examples can cause accidental routing into a skill that uploads user material and performs remote actions without sufficiently clear user intent.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The catch-all rule routing "Everything else" to SSE makes the skill activation scope effectively open-ended. In this skill, that is more dangerous because SSE sends user text to an external backend and may trigger edits or processing based on backend responses, so ambiguous prompts can lead to unintended remote data handling and billable or persistent actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs automatic backend connection and anonymous token acquisition on first open, with only a brief setup message and no meaningful warning or consent flow. This is dangerous because it initiates outbound authentication and creates a remote session before the user has explicitly agreed to network access, credential minting, or remote processing of their data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Although the text mentions that rendering happens server-side, it does not provide a clear privacy warning that uploaded text, images, and files are transmitted to and processed by a remote cloud service. In a media skill handling user-supplied content, this omission materially increases privacy and compliance risk because users may share sensitive assets without understanding where they are sent.

VirusTotal

66/66 vendors flagged this skill as clean.