generate-video
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script (
scripts/generate_video.py) viauv runto interact with the Volcengine Ark API. This is the intended behavior for the skill's operations. - [EXTERNAL_DOWNLOADS]: The script downloads generated video files from signed URLs provided by the Volcengine Ark platform (targeting domains such as
volces.comorbytepluses.com). - [DATA_EXFILTRATION]: User-provided text prompts and local image files (encoded as Base64 data URIs) are transmitted to Volcengine Ark API endpoints for video generation. This represents the primary functionality of the skill using a well-known service provider.
- [REMOTE_CODE_EXECUTION]: The script utilizes dynamic path discovery to locate and load a local configuration helper (
lib/progressive_env.py) by inspecting parent directories and environment variables, which is a common pattern for portable agent skills. - [PROMPT_INJECTION]: The skill provides an indirect prompt injection surface by processing user-supplied prompts and images for use in a generative AI model.
- Ingestion points: Text prompt arguments and image file paths (
--first-frame,--last-frame,--image). - Boundary markers: None; prompts are passed directly to the API payload as instructed.
- Capability inventory: The skill has permissions for network communication (requests), file reading (image inputs), and file writing (output video).
- Sanitization: Validates the existence of image files and converts them to standard Base64 format before transmission.
Audit Metadata