dreamina-cli-text2video

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the official CLI tool from the Dreamina product website (jimeng.jianying.com/cli).
  • [REMOTE_CODE_EXECUTION]: The documentation includes a setup command that downloads and executes a script directly in the shell (curl -fsSL ... | bash). This is pointed to the official service domain for the Dreamina tool.
  • [COMMAND_EXECUTION]: The skill makes extensive use of the dreamina CLI tool to perform operations such as text2video, user_credit, query_result, list_task, and session management.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill ingests user-supplied text through the --prompt argument in various dreamina text2video commands defined in SKILL.md and the example files.
  • Boundary markers: The skill references general validation checklists and workflow contracts, but does not specify technical delimiters (like XML tags or specific delimiters) to wrap the user-provided prompt content within the CLI command.
  • Capability inventory: The skill uses the dreamina CLI to perform network-based video generation requests and local file system operations (e.g., downloading results via --download_dir).
  • Sanitization: There is no explicit mention of sanitizing or escaping the prompt content before it is passed to the shell command, although this is the standard intended use case for the tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 02:54 AM