manga-style-video
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes Python scripts in the scripts directory to communicate with the Volcengine Ark API. These scripts process user input from the command line for prompt text, style selection, and file paths.
- [EXTERNAL_DOWNLOADS]: Fetches resulting video files from Volcengine's API infrastructure. The scripts poll for task completion and use the provided URL to download the video file locally using standard library functions.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. User-supplied descriptions are concatenated with hardcoded style presets before being sent to the remote video generation model. Evidence: Ingestion points include the prompt argument in text-to-video and image-to-video scripts; there are no boundary markers or delimiters separating user input from the style templates; the scripts have the capability to write files and perform network operations; no sanitization or validation of the input strings is performed.
Audit Metadata