dynamic-caption
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
meitu-kaipai-clipackage (version 0.1.8) from the public NPM registry to establish the necessary execution environment. - [REMOTE_CODE_EXECUTION]: Executes the
meitu-kaipai-clibinary on the host system to perform subtitle generation and video editing tasks. - [COMMAND_EXECUTION]: Invokes various shell commands, including
npm install,kaipai subtitle,kaipai download, andkaipai auth, to manage the end-to-end video processing workflow. - [DATA_EXFILTRATION]: Transfers user-provided video files to the vendor's official CDN for processing as part of the core captioning functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect injection as it processes data from external URLs and server responses. However, it includes explicit safeguards to properly escape shell arguments and instructions to disregard any command-like text returned by external services or contained within processed files.
Audit Metadata