kling-official
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides configuration and technical guidance for using the official Kling AI API integration within the OpenMontage framework. All described behaviors align with the legitimate use of the service.- [DATA_EXPOSURE_AND_EXFILTRATION]: Authentication is managed via the
KLING_API_KEYenvironment variable and passed in theAuthorizationheader to the official Kling API endpoint (api-singapore.klingai.com). The skill explicitly warns against unauthorized data exfiltration paths (e.g., through fal.ai gateways) and requires user confirmation for media processing involving multiple detected faces.- [EXTERNAL_DOWNLOADS]: No external downloads or remote scripts are executed. The skill references internal vendor-provided Python scripts (tools/_kling/*.py) for media normalization and account management.- [PROMPT_INJECTION]: No evidence of prompt injection or instructions to bypass safety guidelines was found. The skill includes specific error handling for the API's own safety policy violations (code 1301).- [INDIRECT_PROMPT_INJECTION]: The skill defines parameters for processing user-supplied prompts. While this represents a standard integration surface, the documentation includes constraints such as character limits and structured multi-prompt formats that support safe handling of user input.
Audit Metadata