qinghu-viral-video-womens
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Node.js runtime from nodejs.org and the qhkit library from the npm registry. These are well-known and trusted entities. The installation process implements a mandatory integrity check using SHA256 hashes to prevent the execution of tampered files.
- [COMMAND_EXECUTION]: The skill uses a set of qhkit commands to manage AI workflows, including estimating costs, generating videos, and checking status. These operations are directly related to the skill's functionality.
- [PERSISTENCE]: The setup instructions include a step to add the new Node.js binary path to the user's ~/.bashrc. This ensures the tool remains available in future shell sessions, which is a standard configuration procedure for portable software installations.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external video and image assets to perform character motion migration.
- Ingestion points: Reference video files and model image files provided via the params.json configuration in SKILL.md.
- Boundary markers: The skill does not explicitly use delimiters or "ignore" instructions for these media assets.
- Capability inventory: The qhkit tool has the capability to read local files, perform network uploads to the vendor's domain, and execute workflow-related commands.
- Sanitization: Input sanitization and safety filtering are handled by the vendor's CLI and the backend AI processing engine.
Audit Metadata