qwencloud-video-generation

Pass

Audited by Gen Agent Trust Hub on May 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run in the scripts/gossamer.py file to execute version-check scripts and potentially triggers shell commands via npx for skill updates. It also provides recipes and instructions for the agent to execute ffmpeg and python CLI commands to perform local media operations like concatenation and audio overlay.
  • [EXTERNAL_DOWNLOADS]: The skill downloads generated video files from the vendor's official API endpoints (dashscope-intl.aliyuncs.com). It also instructs the agent to download the moviepy library from the official Python Package Index (PyPI) when local media processing is required.
  • [DATA_EXFILTRATION]: The skill is designed to upload user-provided local media (images, audio, and video) to the vendor's cloud storage (DashScope OSS) to facilitate video generation. This behavior is the intended primary purpose of the skill and is clearly documented for the user.
  • [SAFE]: The skill implements robust security measures for handling API keys, including automated masking (mask_key in qwencloud_lib.py) and explicit warnings against hardcoding credentials. All remote resources and update instructions point to trusted vendor-managed infrastructure (QwenCloud).
Audit Metadata
Risk Level
SAFE
Analyzed
May 4, 2026, 03:43 AM