byted-ind-ecom-prompt-to-video
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads local file paths provided as arguments (
--first_frame,--reference_images, etc.) to facilitate media uploads for video generation. Assets are either converted to Base64 or uploaded to the user's configured Volcengine TOS (Tencent Object Storage) bucket. - [CREDENTIALS_SAFE]: The skill correctly implements security best practices by retrieving sensitive API keys and secrets (
ARK_API_KEY,VOLC_SECRET_KEY) from environment variables or a.envfile, rather than hardcoding them. - [EXTERNAL_DOWNLOADS]: The
generate.pyscript downloads generated video content from the Volcengine Ark platform (ark.cn-beijing.volces.com) to re-upload them to the user's personal TOS bucket. These operations are restricted to the vendor's official infrastructure. - [COMMAND_EXECUTION]: The skill executes Python scripts to interact with APIs. It does not use unsafe functions like
eval()oros.system()with unsanitized user input. - [INDIRECT_PROMPT_INJECTION]: The skill accepts arbitrary text prompts and media URLs which are passed to the video generation model. While this constitutes an ingestion point for untrusted data, the impact is minimal as the output is a generated video file rather than executable instructions for the agent.
Audit Metadata