weibo-upload
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
sau(social-auto-upload) CLI tool to log in, check account status, and upload video files. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided strings (title, description, tags) and interpolates them into command-line arguments. This presents a potential surface for command injection if inputs are not properly sanitized or quoted by the agent, though the documentation provides examples using double quotes for mitigation.
- Ingestion points: User-provided title, description, and tags strings used in the
upload-videocommand. - Boundary markers: The skill documentation uses double quotes around string arguments in examples.
- Capability inventory: Execution of shell commands via the
sauutility. - Sanitization: No specific sanitization or validation logic is explicitly defined within the skill instructions beyond the example usage.
Audit Metadata