text-to-video
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill is configured to access sensitive authentication files. Evidence: Frontmatter requirements and metadata specify reading credentials from
~/.meitu/credentials.jsonto obtainMEITU_OPENAPI_ACCESS_KEYandMEITU_OPENAPI_SECRET_KEYfor the Meitu API. - [COMMAND_EXECUTION]: Executes a third-party CLI tool with runtime parameters derived from user input. Evidence: The skill invokes the
meitucommand (e.g.,meitu text-to-video --prompt "{video_description}" ...) to process video generation tasks. - [PROMPT_INJECTION]: Identified vulnerability surface for indirect prompt injection through untrusted data ingestion.
- Ingestion points: User-provided content for the
promptandvideo_descriptionparameters used in themeitucommand. - Boundary markers: None identified; user input is interpolated directly into command-line arguments.
- Capability inventory: Execution of the
meituCLI tool and file writing permissions to local directories (./output/,~/.openclaw/workspace/visual/). - Sanitization: There is no evidence of validation or sanitization of the user-provided prompt strings before they are passed to the execution tool.
Audit Metadata