Audio To Video

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:38 PM UTC
• Version:
  1.0.0

Overview

This skill is a cloud audio-to-video helper whose remote API use, token handling, and file uploads are broadly aligned with its stated purpose, with privacy and activation caveats users should understand.

Install only if you are comfortable sending audio, image, or video files and related project metadata to NemoVideo’s cloud API. Use non-sensitive media unless you have reviewed the provider’s privacy and retention terms, and prefer an explicit user-controlled NEMO_TOKEN if you do not want anonymous token creation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is presented as an audio-to-video converter, but its documented accepted inputs include video and image files. This capability mismatch can mislead users about what data types may be uploaded and processed remotely, increasing the chance of unintended data disclosure or broader-than-expected tool activation.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation guidance includes broad phrases like generic export or conversational fallback wording that could match ordinary user speech. This raises the risk of accidental activation, which may trigger backend connection setup, token acquisition, or data uploads without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill says rendering happens server-side, but it does not give a clear upfront privacy warning that uploaded audio and project state are sent to a third-party cloud backend. Users may share sensitive recordings believing processing is local or not appreciating the extent of remote retention and handling.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill automatically uses an environment token if present or silently acquires an anonymous token otherwise, without clearly informing the user. Hidden credential use can surprise users, consume account credits, and create unintended linkage between local environment secrets and remote service actions.

VirusTotal

64/64 vendors flagged this skill as clean.