kuaishou-upload
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and templates for executing the
sauCLI tool for account management and content uploading. The Python template (scripts/examples/kuaishou_cli_template.py) correctly usessubprocess.runwith argument lists andshlex.quotefor display, mitigating shell injection risks.\n- [EXTERNAL_DOWNLOADS]: The skill references the installation ofpatchrightand Chromium via a well-known mirror (https://npmmirror.com/mirrors/playwright), which is a standard practice for browser automation tools in certain environments.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes untrusted user data for titles and descriptions.\n - Ingestion points: User-supplied metadata (
--title,--desc,--note) enters the agent context via the CLI contract instructions inreferences/cli-contract.md.\n - Boundary markers: Absent; the instructions do not specify delimiters for user-provided text.\n
- Capability inventory: The skill performs subprocess command execution and file operations (cookie management) as documented in
scripts/examples/.\n - Sanitization: Examples use standard shell quoting, but the skill relies on the agent to sanitize input before invoking the CLI.
Audit Metadata