libtv-video
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The main script,
libtv_video.py, uses thesubprocessmodule to manage background polling and to execute a helper script,feishu_send_video.py, for result delivery. These commands are invoked using list-based arguments rather than string shells, which is a secure practice to prevent command injection. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a relay, passing user descriptions to external image and video generation APIs.
- Ingestion points: The
messageparameter in thecreate-sessioncommand withinscripts/libtv_video.py. - Boundary markers: None; the skill relays the user prompt verbatim to the backend service as per its design.
- Capability inventory: The skill possesses network capabilities for API interaction and result downloading, as well as local process execution for delivery automation.
- Sanitization: User input is not sanitized, as the skill's primary function is to relay descriptions directly to the generation engine.
Audit Metadata