meitu-video-dance
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
meitu-clipackage via the npm registry (npm install -g meitu-cli@latest). This tool is provided by the skill's author to interface with their API. - [COMMAND_EXECUTION]: The skill executes the
meituCLI tool to perform video motion transfer, image cutout, and image enhancement operations. - [INDIRECT_PROMPT_INJECTION]: The skill processes local project files to gather context for its operations, creating a potential attack surface.
- Ingestion points: The skill reads
DESIGN.md,quality.yaml,global.md, andobservations.yamlto extract quality preferences and creative direction. - Boundary markers: No specific delimiters or "ignore instructions" markers are defined for the content read from these files.
- Capability inventory: The skill can execute shell commands via the
meituCLI and perform network operations to the Meitu OpenAPI. - Sanitization: The instructions do not specify any sanitization or validation logic for the text extracted from the local project files before it is used in prompt construction.
Audit Metadata