kaipai-video-remove-watermark
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill handles the installation of the
meitu-kaipai-clipackage vianpm installto ensure the required vendor-provided tools are present. This operation uses a specific version (0.1.11) and follows standard global installation patterns. - [COMMAND_EXECUTION]: The skill runs a setup script (
ensure-cli.mjs) and calls thekaipaicommand to execute video processing tasks. These commands are executed as subprocesses with arguments passed as arrays, reducing the risk of shell-based command injection. - [DATA_EXFILTRATION]: The skill downloads media from user-provided URLs and uploads them to the vendor's CDN. These actions are the primary mechanism for the tool's intended functionality (video watermark removal) and are directed to the vendor's infrastructure.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external media files and URLs, which serves as an entry point for untrusted data.
- Ingestion points: Media files and URLs provided in user requests or context (SKILL.md).
- Boundary markers: None explicitly defined; the skill delegates processing directly to the vendor's CLI.
- Capability inventory: Invokes subprocesses via
meitu-kaipai-clifor processing andensure-cli.mjsfor environment setup (scripts/ensure-cli.mjs). - Sanitization: CLI calls use structured argument arrays in
spawnSyncrather than shell strings (scripts/ensure-cli.mjs).
Audit Metadata