linkpix-vidu-q2-sales
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPERSISTENCECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install Node.js binaries from nodejs.org and the qhkit CLI package from official registries (npmjs.com or its well-known mirror npmmirror.com). These downloads include checksum verification to ensure file integrity.- [PERSISTENCE]: The instructions suggest adding the Node.js installation path to the shell profile (~/.bashrc) to ensure the required tooling persists across agent sessions.- [COMMAND_EXECUTION]: The skill utilizes the vendor's qhkit CLI tool to perform video generation, status checks, and configuration management. It relies on standard shell execution for these operational tasks.- [DYNAMIC_EXECUTION]: Short Python and Node.js code snippets are used to compress or resize local images that exceed the service's file size limits, employing common libraries like Pillow or sharp-cli.- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: User-provided descriptions, selling points, and prompts are ingested via SKILL.md for video generation.
- Boundary markers: The skill instructs the agent to pass these inputs as structured JSON strings to the CLI tool, reducing the risk of command injection.
- Capability inventory: The skill possesses capabilities for local file reading, subprocess execution (qhkit, python, node), and network communication through the CLI.
- Sanitization: The agent is explicitly required to confirm parameters and cost estimates with the user before submitting any generation tasks, providing a human-in-the-loop safety check.
Audit Metadata