Loop Video Maker Free

• Outcome: Review
• Latest audit: May 29, 2026 at 9:35 PM UTC
• Version:
  1.0.0

Overview

This appears to be a real cloud media-processing skill, but it asks an agent to connect to NemoVideo and send user media/prompts with broader capabilities than the short description makes clear.

Install only if you are comfortable sending your prompts and uploaded media to NemoVideo cloud services. Avoid using private, regulated, client, or confidential media unless the publisher provides clear retention, privacy, and consent terms.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest presents the skill as a narrow looping/export tool, but the body documents broader editing capabilities such as general media editing, overlays, audio handling, and stateful timeline manipulation. This mismatch can mislead users and host platforms about the skill's effective scope, weakening informed consent and review controls for a remote-processing skill that uploads user media and sends prompts to a third-party backend.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documented supported formats include non-video inputs and outputs such as images and audio, which materially exceeds the stated video-looping use case. This expands the data handling surface without clear disclosure, increasing the chance that users provide content they would not have shared if the broader media-processing scope had been transparent.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The invocation examples use very generic phrases like "export" and "convert my video clips," which can overlap with ordinary conversation in adjacent contexts. Overbroad triggers raise the risk of unintended activation, causing users to upload or transmit media and prompts to the remote backend without a sufficiently deliberate action.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Although the document later mentions server-side rendering, the initial setup flow automatically connects to a backend, acquires an anonymous token, and creates a remote session without a prominent up-front warning that user media and prompts will be sent to external cloud services. For a media-processing skill handling potentially sensitive user files, insufficient disclosure undermines informed consent and increases privacy risk.

VirusTotal

66/66 vendors flagged this skill as clean.