xyq-skill
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads generated media assets from the official Xiao Yun Que platform (jianying.com). These downloads are essential for providing the user with the generated output and target a well-known service domain.
- [COMMAND_EXECUTION]: The skill executes provided Python scripts to handle API interactions and local file management. These scripts are transparent, rely on Python standard libraries, and use environment variables for sensitive access keys.
- [PROMPT_INJECTION]: The skill functions as an intermediary for user-generated prompts and platform-returned data.
- Ingestion points: User descriptions passed to
submit_run.pyand result URLs processed bydownload_results.py. - Boundary markers: None explicitly used in the API payload construction.
- Capability inventory: Network access via
urlliband local file read/write operations. - Sanitization: Basic MIME type validation is performed on file uploads to ensure only images and videos are processed.
Audit Metadata