kling-official

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides configuration and technical guidance for using the official Kling AI API integration within the OpenMontage framework. All described behaviors align with the legitimate use of the service.- [DATA_EXPOSURE_AND_EXFILTRATION]: Authentication is managed via the KLING_API_KEY environment variable and passed in the Authorization header to the official Kling API endpoint (api-singapore.klingai.com). The skill explicitly warns against unauthorized data exfiltration paths (e.g., through fal.ai gateways) and requires user confirmation for media processing involving multiple detected faces.- [EXTERNAL_DOWNLOADS]: No external downloads or remote scripts are executed. The skill references internal vendor-provided Python scripts (tools/_kling/*.py) for media normalization and account management.- [PROMPT_INJECTION]: No evidence of prompt injection or instructions to bypass safety guidelines was found. The skill includes specific error handling for the API's own safety policy violations (code 1301).- [INDIRECT_PROMPT_INJECTION]: The skill defines parameters for processing user-supplied prompts. While this represents a standard integration surface, the documentation includes constraints such as character limits and structured multi-prompt formats that support safe handling of user input.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 02:19 AM
Security Audit — agent-trust-hub — kling-official