pet-commerce-creator
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
yt-dlplibrary to download video files and metadata from user-provided URLs (such as TikTok, YouTube, and Bilibili). This is a core functionality of the skill's 'Video Downloader' and 'Explosive Content Analysis' modules.\n- [COMMAND_EXECUTION]: Thescripts/video_downloader.pyandscripts/coze_video_api.pyscripts perform local file operations and network requests toapi.coze.cn. These actions are necessary for managing downloaded media and interacting with the Coze platform.\n- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it processes untrusted metadata from external video links. \n - Ingestion points:
scripts/video_downloader.pyextracts metadata (titles, descriptions, and tags) from remote URLs.\n - Boundary markers: None identified; metadata is processed directly by analysis agents.\n
- Capability inventory:
scripts/coze_video_api.py(network API communication) andscripts/video_downloader.py(file system access).\n - Sanitization: No explicit sanitization or validation of retrieved metadata was found before it is used by the analysis agents.
Audit Metadata