Media.io Video to Video API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:25 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward Media.io API wrapper that uses a disclosed API key to submit video transformation requests and check results.

Install only if you are comfortable giving the skill a Media.io API key and sending media URLs, image URLs, and prompts to Media.io for processing. Prefer a dedicated, revocable API key and avoid using sensitive private media unless you trust Media.io's handling of that data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: This JSON manifest-like file lists skill names and descriptions such as "Credits" and "Task Result" without any explicit activation scope, trigger phrases, or negative examples. For manifest files, such broad labels can make it unclear when each skill should activate versus when similar user requests should be handled by another skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

"description": "API to query user credits balance.",
    "api_header": "{\"list\":[{\"name\":\"X-API-KEY\",\"value\":\"API key to authorize requests\"},{\"name\":\"Content-Type\",\"value\":\"application/json\"}],\"title\":\"Authorizations\",\"describe\":\"Add the following authorization information in the request header\"}",
    "api_body": "{\"title\":\"Request Body\",\"category\":[{\"list\":[],\"title\":\"Query Credits\",\"describe\":\"Request body to query user credits balance\"}]}",
    "api_request_demo": "{\"title\":\"Example Request\",\"request\":[{\"title\":\"Query User Credits\",\"language\":\"cURL\",\"code_example\":\"curl --request POST --url https://openapi.media.io/user/credits --header 'Content-Type: application/json' --header 'X-API-KEY: <api-key>' --data '{}'\"}]}",
    "api_response": "{\"list\":[{\"name\":\"code\",\"type\":\"integer\",\"describe\":\"Response status code, 0 indicates success\"},{\"name\":\"msg\",\"type\":\"string\",\"describe\":\"Response message, empty string on success\"},{\"name\":\"data\",\"type\":\"object\",\"describe\":\"Response data object\"},{\"name\":\"credits\",\"type\":\"integer\",\"describe\":\"User credits balance\"}],\"title\":\"Response\"}",
    "api_code_demo": "{\"list\":[{\"code\":\"0\",\"describe\":\"Success\"}],\"title\":\"Status Code\"}",
    "content": null,

• Confidence: 60% confidence
• Finding: curl --request POST --url https://openapi.media.io/user/credits --header 'Content-Type: application/json' --header 'X-API-KEY: <api-key>' --data '{}'\"}]}", "api_response": "{\"list\":[{\"name\":\

VirusTotal

65/65 vendors flagged this skill as clean.