linkpix-minimax-h3-sales
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Node.js runtime from
nodejs.organd the@iqinghu/qhkitutility from the official NPM registry. These are well-known and trusted sources for developer tooling. - [COMMAND_EXECUTION]: Utilizes shell commands for environment configuration, package installation, and file integrity validation. The use of
sha256sumto verify the Node.js binary before extraction is a notable security best practice. - [DYNAMIC_EXECUTION]: Includes helper scripts for Python (Pillow) and Node.js (sharp-cli) to perform local image compression. These operations are restricted to processing user-provided media to meet file size constraints.
- [INDIRECT_PROMPT_INJECTION]: As the skill interpolates user-provided text into commands for video generation, an indirect prompt injection surface exists. However, the instructions employ structured parameters and specific action boundaries which align with standard safe integration patterns for AI agents.
Audit Metadata