Feed Designs You Video Gen

• Outcome: Pass
• Latest audit: May 29, 2026, 8:26 PM
• Version:
  1.0.0

Overview

This skill is a coherent WeryAI video-generation helper, with disclosed API-key and network use and no evidence of hidden local access or persistence.

Install only if you are comfortable sending prompts, generation parameters, and any supplied public image URLs to WeryAI using your API key. Avoid private screenshots or sensitive imagery unless you intentionally approve that external processing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill is presented as a narrowly scoped generator for a specific rhetorical five-beat vertical short, but the underlying behavior appears to support broader generic video-generation operations, task inspection, model enumeration, and dry-run API request construction. That mismatch is dangerous because users and higher-level policy systems may grant trust or invoke the skill under false assumptions, enabling broader external API actions than the description suggests.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger tests rely on broad paraphrases like references to scrolling phones, recommendations, and doomscroll critique without tighter boundaries, so the skill may activate on loosely related user requests. In an agent environment, overly ambiguous activation increases the chance of unintended prompt expansion or tool invocation for requests that only tangentially match the domain, which can cause misrouting and unsafe automation behavior.

VirusTotal

65/65 vendors flagged this skill as clean.