tencent-upload
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing shell commands via the 'social-auto-upload' (sau) CLI tool. It provides instructions for logging into accounts, checking status, and performing video uploads with various parameters such as titles, descriptions, and scheduling.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests untrusted user data for video metadata.
- Ingestion points: The skill accepts user-provided input for the --title, --desc, and --tags parameters, as well as the --file path.
- Boundary markers: There are no explicit boundary markers or instructions to the agent to sanitize or ignore instructions embedded within the video metadata.
- Capability inventory: The skill possesses the capability to execute shell commands and access the local file system for video uploads.
- Sanitization: No sanitization logic is present in the skill instructions to prevent potential command injection or malicious string processing by the underlying CLI tool.
Audit Metadata