byted-las-video-inpaint
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the official LAS SDK from the vendor's domain (volces.com) during the environment setup in
scripts/env_init.sh. - [COMMAND_EXECUTION]: The skill executes shell scripts and the
lasutilCLI tool to manage video processing workflows, including file uploads and task polling. - [DYNAMIC_EXECUTION]: The polling script
scripts/poll_background.shuses a Python one-liner to parse and extract task status metadata from JSON responses. - [INDIRECT_PROMPT_INJECTION]: The skill processes remote video content which constitutes a potential ingestion surface for untrusted data.
- Ingestion points: The
video_urlparameter used in the submit task workflow inSKILL.md. - Boundary markers: No explicit boundary markers or safety instructions for content processing are defined in the skill instructions.
- Capability inventory: The skill has capabilities to execute CLI tools, manage local files in a temporary directory, and interact with network APIs.
- Sanitization: Input validation is limited to file extension checking in
scripts/check_format.sh.
Audit Metadata