Security audit

Media.io Kling Video Generator

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Media.io API wrapper for Kling video generation, with expected remote API use and API-key handling disclosed in the skill files.

Install only if you are comfortable using a Media.io API key and sending generation inputs such as prompts, image URLs, video URLs, task IDs, and related parameters to Media.io. Use a dedicated or least-privilege key where possible, monitor Media.io usage, and avoid submitting confidential, regulated, or non-consented media.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs users to supply an API key and invoke outbound requests to Media.io, but it does not warn that prompts, images, or other media may be transmitted to a third-party service. This creates a real privacy and data-handling risk because users may unknowingly send sensitive content or secrets to an external API under the assumption the operation is local or fully trusted.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation instructs users to send an X-API-KEY to an external service without any trust boundary, credential-handling, or secret-management warning. In an agent-skill context, this increases the chance that users or downstream tooling will blindly transmit sensitive credentials to a third party, which can lead to credential exposure or misuse.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The generation docs direct users to provide image URLs for remote processing but omit any privacy or data-sharing notice. In a skill setting, that omission can cause users to unknowingly submit private or internal media URLs to an external vendor, creating confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: Enabling audio generation by default means additional content may be derived and processed remotely, yet the documentation gives no notice of that expanded processing scope. In agent workflows, hidden defaults can cause users to share more data than intended or create outputs with privacy, moderation, or policy implications.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This documentation describes sending both video and image inputs to an external service without warning users that their media will be processed off-platform. Because video and image files often contain sensitive personal or proprietary material, the lack of disclosure materially increases privacy and data-governance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.