hupu-upload

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of the sau (social-auto-upload) command-line tool to interact with Hupu services, including session management and content publication.
  • [INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection by processing untrusted user input for video metadata and incorporating it into shell commands.
  • Ingestion points: User-supplied values for video titles, descriptions, and tags are ingested and used as arguments for the sau hupu upload-video command.
  • Boundary markers: Absent; there are no specified delimiters or instructions to ignore embedded commands within the user-provided text.
  • Capability inventory: The skill utilizes shell command execution to perform file and network operations via the sau CLI.
  • Sanitization: Absent; the instructions do not include steps to sanitize, escape, or validate the user-provided strings before they are interpolated into the command-line execution string.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 11:27 PM