generate-video

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a Python script (scripts/generate_video.py) via uv run to interact with the Volcengine Ark API. This is the intended behavior for the skill's operations.
  • [EXTERNAL_DOWNLOADS]: The script downloads generated video files from signed URLs provided by the Volcengine Ark platform (targeting domains such as volces.com or bytepluses.com).
  • [DATA_EXFILTRATION]: User-provided text prompts and local image files (encoded as Base64 data URIs) are transmitted to Volcengine Ark API endpoints for video generation. This represents the primary functionality of the skill using a well-known service provider.
  • [REMOTE_CODE_EXECUTION]: The script utilizes dynamic path discovery to locate and load a local configuration helper (lib/progressive_env.py) by inspecting parent directories and environment variables, which is a common pattern for portable agent skills.
  • [PROMPT_INJECTION]: The skill provides an indirect prompt injection surface by processing user-supplied prompts and images for use in a generative AI model.
  • Ingestion points: Text prompt arguments and image file paths (--first-frame, --last-frame, --image).
  • Boundary markers: None; prompts are passed directly to the API payload as instructed.
  • Capability inventory: The skill has permissions for network communication (requests), file reading (image inputs), and file writing (output video).
  • Sanitization: Validates the existence of image files and converts them to standard Base64 format before transmission.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 06:58 PM
Security Audit — agent-trust-hub — generate-video