jimeng-skill
Fail
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes a command to install the Dreamina CLI by downloading a script from its official domain at jimeng.jianying.com and piping it directly to bash.
- [COMMAND_EXECUTION]: The skill uses shell features like command substitution to read prompt files and while-loops for task status polling.
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates external data from local files and CLI outputs into shell commands without sanitization. Ingestion points include local prompt files and tool-provided download URLs. The skill lacks boundary markers and possesses capabilities for network access and file writing.
Recommendations
- HIGH: Downloads and executes remote code from: https://jimeng.jianying.com/cli - DO NOT USE without thorough review
Audit Metadata