Security audit
dy-caption
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed video-to-text helper that sends video links and an API key to Videosays for transcription.
Install only if you are comfortable sending video links and your Videosays API key to the Videosays service, and only process videos you own or have permission to process. Be aware that the skill runs an external npm CLI via `npx` and stores its API key locally in `~/.videosays`.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.