aliyun-vidu-video

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a Python script scripts/generate_vidu_video.py to facilitate API interaction, which includes network requests and local file operations.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied content, creating a vulnerability surface for indirect injection.
  • Ingestion points: User-provided prompt strings and media URLs are processed via CLI arguments and documented in SKILL.md.
  • Boundary markers: The instructions lack explicit delimitation or instructions to ignore potential commands within user data.
  • Capability inventory: The skill employs the requests library for network communication and has local file-write capabilities for outputting task data.
  • Sanitization: While the script validates configuration parameters like model names and media counts, it does not sanitize the content of the text prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 08:17 AM