klingai-upgrade-migration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The reference script
references/upgrade-procedure.mdincludes functionality in theUpgradeProcedureclass that usessubprocess.runto callpip install. This is intended to facilitate the migration and upgrade of SDK dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill processes migration-related configuration and model data, which creates a surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the context through model documentation parsing and configuration file reading in
SKILL.mdandreferences/migration-scripts.md. - Boundary markers: The instructions utilize clear markdown headers and code blocks to separate tasks, though they lack explicit directives to ignore instructions that might be embedded in processed data.
- Capability inventory: The skill possesses capabilities for network operations (
requeststo Kling AI API), file system modification (json.dumpandshutil.copy2), and command execution (pipvia subprocess). - Sanitization: The scripts employ standard libraries like
astandreto scan source code for patterns andjsonfor configuration parsing, providing structural validation of the data being processed.
Audit Metadata