vidu-video
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python script that performs network requests to the Vidu API using urllib.request.urlopen and manages local task states through os.replace and os.fdopen.
- [EXTERNAL_DOWNLOADS]: The skill interacts with the api.vidu.com endpoint, which is the official API for the Vidu video generation service.
- [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: User-provided video prompts and asset URLs are ingested by the generation script in SKILL.md. 2. Boundary markers: The instructions mandate a dry-run first policy and explicit manual review of the request payload. 3. Capability inventory: The script possesses capabilities for network communication and writing to a local state directory (.vidu-state). 4. Sanitization: Security is enforced via a mandatory SHA-256 manifest check, requiring the environment variable VIDU_APPROVED_MANIFEST_SHA256 to match the calculated hash of the operator-approved manifest before execution.
Audit Metadata