Security audit
douyin-to-text
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed video-to-text helper that sends video links and a Videosays API key to the Videosays service for transcription.
Install only if you are comfortable sending video links and your Videosays API key to Videosays, and only transcribe videos you own or have permission to process. Because it executes an external npm package through `npx`, keep normal dependency trust and account-token hygiene in mind.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.