byted-las-video-resize
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
scripts/env_init.shautomatically downloads and installs a Python wheel package (las_sdk-0.2.0-py3-none-any.whl) from a remote Volcengine domain. This is a vendor-owned resource used for the skill's primary functionality. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to
las-ai-cn-beijing-online.tos-cn-beijing.volces.comto fetch a system manifest and the official SDK package. These resources are hosted on the vendor's infrastructure. - [COMMAND_EXECUTION]: The skill relies on executing local shell scripts (
scripts/env_init.sh,scripts/poll_background.sh) and thelasutilCLI tool to manage video processing tasks and environment configuration. - [METADATA_POISONING]: The file
scripts/generate_result.md.shcontains template content and logic specifically for an ASR (Speech-to-Text) skill, including references to transcripts and audio duration, which is inconsistent with the stated purpose of video resizing. While likely a documentation error, it represents a metadata inconsistency.
Audit Metadata