aliyun-wan-r2v
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of the dashscope Python package, which is the official library for interacting with Alibaba Cloud Model Studio services.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by ingesting and processing external content such as video reference URLs.
- Ingestion points: The skill receives external data through the prompt and reference_video parameters in SKILL.md and the prepare_r2v_request.py script.
- Boundary markers: There are no explicit markers or instructions to the model to ignore potential directives embedded within the reference video metadata or associated data.
- Capability inventory: The skill leverages the dashscope SDK for video generation and includes scripts capable of reading and writing local JSON files.
- Sanitization: The input parameters are incorporated into the JSON request payload without validation or filtering for potential injection patterns.
Audit Metadata