dynamic-caption

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the meitu-kaipai-cli package (version 0.1.8) from the public NPM registry to establish the necessary execution environment.
  • [REMOTE_CODE_EXECUTION]: Executes the meitu-kaipai-cli binary on the host system to perform subtitle generation and video editing tasks.
  • [COMMAND_EXECUTION]: Invokes various shell commands, including npm install, kaipai subtitle, kaipai download, and kaipai auth, to manage the end-to-end video processing workflow.
  • [DATA_EXFILTRATION]: Transfers user-provided video files to the vendor's official CDN for processing as part of the core captioning functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect injection as it processes data from external URLs and server responses. However, it includes explicit safeguards to properly escape shell arguments and instructions to disregard any command-like text returned by external services or contained within processed files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 01:40 AM