xyq-skill

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads generated media assets from the official Xiao Yun Que platform (jianying.com). These downloads are essential for providing the user with the generated output and target a well-known service domain.
  • [COMMAND_EXECUTION]: The skill executes provided Python scripts to handle API interactions and local file management. These scripts are transparent, rely on Python standard libraries, and use environment variables for sensitive access keys.
  • [PROMPT_INJECTION]: The skill functions as an intermediary for user-generated prompts and platform-returned data.
  • Ingestion points: User descriptions passed to submit_run.py and result URLs processed by download_results.py.
  • Boundary markers: None explicitly used in the API payload construction.
  • Capability inventory: Network access via urllib and local file read/write operations.
  • Sanitization: Basic MIME type validation is performed on file uploads to ensure only images and videos are processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 09:24 AM