zynna-scene-builder
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill reads authentication credentials from a vendor-specific local file at
~/.zynna/credentials.jsonor via theZYNNA_SKILLS_API_KEYenvironment variable. These credentials are required for its primary function of interacting with the Zynna video generation service. The code includes dedicated functions to ensure that these sensitive tokens are redacted from logs and error reports. - [EXTERNAL_DOWNLOADS]: Communicates with the Zynna Open Skills API to submit and poll for video generation tasks. The implementation includes a URL validation mechanism that prevents the use of insecure HTTP connections for remote endpoints, unless explicitly overridden for local development.
- [DATA_EXFILTRATION]: Persists task metadata and results into a local
.artifactsdirectory. The skill uses path validation logic to ensure that file operations are confined to the intended project root, effectively mitigating potential directory traversal risks.
Audit Metadata