skills/nexu-io/nexu/libtv-video/Gen Agent Trust Hub

libtv-video

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The main script, libtv_video.py, uses the subprocess module to manage background polling and to execute a helper script, feishu_send_video.py, for result delivery. These commands are invoked using list-based arguments rather than string shells, which is a secure practice to prevent command injection.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as a relay, passing user descriptions to external image and video generation APIs.
  • Ingestion points: The message parameter in the create-session command within scripts/libtv_video.py.
  • Boundary markers: None; the skill relays the user prompt verbatim to the backend service as per its design.
  • Capability inventory: The skill possesses network capabilities for API interaction and result downloading, as well as local process execution for delivery automation.
  • Sanitization: User input is not sanitized, as the skill's primary function is to relay descriptions directly to the generation engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 03:35 AM