ai-short-drama

该技能目的与其媒体生成能力基本一致，但其实际执行高度依赖通过官方域名远程安装的黑盒 Dreamina CLI，并把登录态与生成任务交给该外部工具处理。功能上更像创作/出片自动化而非窃密工具，但安装信任、凭据委托和外部内容处理使其整体应判为 SUSPICIOUS 的高风险技能，而非确认恶意。

No explicit malware payload (backdoor/reverse shell/crypto/mining) is visible in this bash script, but it contains a high-impact security weakness: it uses eval to build and execute a dreamina command using prompt text sourced from an external markdown file. Because prompt content is untrusted and single-quote escaping is not handled, an attacker who can influence 即梦批量包.md (or the referenced data) can likely achieve shell command injection and arbitrary command execution. Additional risk: the script uploads prompts/images to an external service (expected for generation) and downloads media based on submit_id parsing, which could be tampered by unexpected CLI output.

This module is primarily an installer/launcher, and it does not show overt malicious behaviors like credential theft, persistence, or exfiltration in its own logic. The primary concern is a significant software supply-chain risk: it downloads an external installer over the network and executes it directly (`curl -fsSL URL | bash`) without integrity verification (no checksum/signature/pinning). Secondary concerns include use of a predictable `/tmp` filename for temporary output, which is generally lower severity. Overall, treat this as high-risk due to the unverified remote code execution during installation.