manga-style-video
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with the Volcengine (ByteDance) API at ark.cn-beijing.volces.com to manage video generation tasks. It explicitly disables SSL certificate verification in its network requests, which is a poor security practice but appears to be a developer convenience rather than a malicious backdoor.\n- [COMMAND_EXECUTION]: The script uses subprocess.run to execute the system's curl utility for downloading generated video files. This execution is performed using a list-based argument structure, which mitigates the risk of shell injection.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it interpolates user-provided text into a final prompt for the video generation model.\n
- Ingestion points: The prompt positional argument in scripts/manga_style_video.py.\n
- Boundary markers: Absent; user input is concatenated directly with style-specific templates.\n
- Capability inventory: Includes network requests to the Volcengine API and file downloads via curl.\n
- Sanitization: No sanitization or escaping is performed on the user input before interpolation.
Audit Metadata