veo3-video-gen
Verdict safe, but 2 findings (2 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-07.
The veo3-video-gen skill is a legitimate video generation tool with MODERATE security concerns. The skill correctly uses the Google Gemini API for video generation and implements reasonable functionality for multi-segment video creation. Primary concerns include API key handling via command-line arguments (credential exposure risk), shell execution patterns that could enable command injection, and missing manifest metadata. No evidence of malicious intent, data exfiltration, or prompt injection was found. The skill's behavior matches its stated purpose. Recommended actions: remove CLI API key option, replace shell-based binary checks with safer alternatives, and complete manifest metadata.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Generate and stitch short videos via Google Veo 3.x using the Gemini API (google-genai). Use when you need to create video clips from prompts (ads, UGC-style clips, product demos) and want a reproducible CLI workflow (generate, poll, download MP4, optionally stitch multiple segments).
- Package
- 2 files, 18 KB
- SKILL.md
- 249 words, 5 sections
- Code
- Python (1)
SKILL.md covers: Veo 3 Video Generation (Gemini API) · Generate (text → video) · Generate a longer video by stitching segments · Requirements · Troubleshooting
Findings
MEDIUM Hardcoded API Key Exposure Risk Data Exfiltrationllm
The script accepts API keys via command-line argument (--api-key) which can expose credentials in process listings, shell history, and logs. While environment variable usage (GEMINI_API_KEY) is supported as the primary method, the CLI option creates an unnecessary exposure vector.
--api-key KEY parameter in argparse, get_api_key() function accepts provided_key argumentMEDIUM Command Injection via Subprocess Shell Execution Command Injectionllm
The script uses subprocess.run() with shell=True or bash -lc execution patterns when checking for binaries (ffmpeg). While the immediate usage appears to use shlex.quote() for the binary name, the pattern of shell execution creates potential command injection surfaces if any user-controlled input flows into these calls.
scripts/generate_video.py
subprocess.run(['bash', '-lc', f'command -v {shlex.quote(name)}'], capture_output=True) - uses shell execution patternWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 2.2 KB |
scripts/generate_video.py | script | 16 KB |
Environment variables referenced
GEMINI_API_KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/veo3-video-gen
- Raw scan result: veo-3-video-gen-gemini-api-scan.json
- Badge for your README:
- Request a re-scan