cloudrelay-mediagen
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a self-update mechanism (
scripts/update.py) that fetches release archives from the author's official GitHub repository (CloudRelay-Code/cloudrelay-mediagen-skill). - Security measures include SHA-256 digest verification against the GitHub API response and validation of the archive's internal path structure to prevent traversal.
- Downloaded Python files are validated using syntax compilation before they are staged for replacement.
- [CREDENTIALS_UNSAFE]: The skill implements professional credential handling through
scripts/configure_api_key.py. - It supports secure input (hidden terminal entry) and stores keys in OS-appropriate isolated locations (Windows Environment variables or user-only config files on POSIX).
- The generation scripts (
scripts/generate_image.py,scripts/generate_video.py) include recursive redaction logic to ensure that recognizable API keys are stripped from logs, error messages, and terminal reports. - [COMMAND_EXECUTION]: The skill provides utility scripts for installation and management. While it executes commands for these purposes, they are limited to the skill's own lifecycle and are documented for the user. No arbitrary or hidden command execution from untrusted sources was detected.
- [INDIRECT_PROMPT_INJECTION]: The skill handles user-supplied prompts for media generation. Potential risks are mitigated by the use of standard argument parsing (via
argparse) and the avoidance of shell-based execution for user input within the media generation logic.
Audit Metadata