dreamina-cli
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill references the official installation method for the Dreamina CLI using a script fetched from the product's official domain. Evidence:
curl -fsSL https://jimeng.jianying.com/cli | bashfound inreferences/official-cli-install-to-use.md. - [COMMAND_EXECUTION]: The skill operates by executing various subcommands of the
dreaminaCLI tool to manage user accounts and generate media content. Evidence: Subcommands includelogin,text2image,image2video, andsessionmanagement, as detailed inSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the passing of user-controlled data to a local CLI tool, creating a potential injection surface. Ingestion points: The
--promptflag and file path flags in generation commands take direct user input. Boundary markers: Absent for prompt parameters in the CLI interaction. Capability inventory: Thedreaminatool can read files, perform network uploads, and trigger paid generation tasks. Sanitization: Instructions recommend validating file existence and checking CLI version/help but do not include prompt content sanitization.
Audit Metadata