volcengine-video-understanding
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes video files which could potentially contain embedded instructions (text or audio) that influence the model's behavior.
- Ingestion points: User-provided video file paths and instructions in
scripts/video_understand.py. - Boundary markers: None identified; instructions and video content are passed directly to the API payload.
- Capability inventory: File system read access, network transmission via the
requestslibrary, and optional file write access for output. - Sanitization: No explicit sanitization or filtering of video content or instructions is performed before transmission.
- [SAFE]: The skill interaction is restricted to official Volcengine (ByteDance) API domains at
volces.com, which is a well-known service. Sensitive credentials likeARK_API_KEYare managed via standard environment variables and .env files rather than being hardcoded, following security best practices. The code is direct, transparent, and lacks any patterns of obfuscation, persistence, or unauthorized data exfiltration.
Audit Metadata