video-canvas-expand
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using string interpolation for user input:
meitu video-canvas-expand ... --prompt "{扩展内容描述}". This pattern is vulnerable to command injection if the input contains shell metacharacters (e.g.,;,&,|, or$()), allowing an attacker to execute arbitrary system commands. - [CREDENTIALS_UNSAFE]: The skill configuration explicitly requests read access to sensitive credential files located at
~/.meitu/credentials.json. While these are likely intended for themeitutool's authentication, the availability of these secrets to the agent environment poses a risk of credential exposure if the agent is compromised or misled. - [COMMAND_EXECUTION]: The skill requires the execution of a local binary
meitu. While associated with a known vendor, the skill's implementation relies on the presence of this external executable without verifying its integrity or origin within the instruction file.
Audit Metadata