video-motion-transfer
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the meitu command-line interface to perform video processing tasks. This is the primary intended behavior of the skill.
- [CREDENTIALS_UNSAFE]: The skill accesses authentication keys stored in ~/.meitu/credentials.json. This is a standard vendor practice for the meitu-cli tool to interact with its API.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface where the user-supplied prompt is interpolated into a shell command. Ingestion points: user-provided prompt parameter. Boundary markers: none identified. Capability inventory: subprocess execution of the meitu command. Sanitization: no explicit validation or escaping is documented for the prompt input.
Audit Metadata