Ai Tool For Video Editing

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:38 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed cloud video-editing skill, but users should understand that selected media and editing prompts are sent to NemoVideo's backend.

Install only if you are comfortable sending chosen videos, audio, images, URLs, and edit instructions to NemoVideo's cloud service. Keep NEMO_TOKEN private, avoid sensitive or regulated footage unless you accept the provider's privacy terms, and use explicit video-editing requests to reduce accidental backend calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The suggested trigger phrases are short and generic enough that normal conversation could invoke the skill unintentionally. In this skill's context, accidental activation is more concerning because it can lead to remote session creation and possible upload of user media to a third-party cloud service without a clearly intentional opt-in moment.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The catch-all rule routes 'everything else' to the SSE action, which creates an overly broad trigger surface and makes unintended execution likely. Because the SSE path can transmit arbitrary user text to a remote backend for processing, ambiguous routing increases the risk of data leakage and surprising behavior from ordinary conversation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs users to send raw video footage to a remote GPU-backed cloud service but does not prominently warn about privacy, sensitivity, or third-party processing. This is dangerous because videos often contain faces, voices, locations, documents, and other sensitive information that users may upload without informed consent about where the data is processed.

VirusTotal

66/66 vendors flagged this skill as clean.