tencent-mps
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the official
tencentcloud-sdk-pythonandcos-python-sdk-v5libraries to communicate with Tencent Cloud services. These are well-known, trusted packages from a reputable service provider. - [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection through its media analysis features (e.g., in
scripts/mps_av_understand.py). If an AI agent processes attacker-controlled media URLs, any instructions hidden in the media (such as OCR text or audio transcripts) could attempt to influence the agent's logic. This is an inherent risk of AI media analysis tools and is documented here for awareness. - [DYNAMIC_EXECUTION]: The
scripts/mps_usage.pyscript employsimportlib.utilto dynamically load the localload_env.pyhelper module. This loading is performed from a static, local file path within the skill's directory and is used for environment configuration before API calls.
Audit Metadata