qwencloud-video-generation
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runin thescripts/gossamer.pyfile to execute version-check scripts and potentially triggers shell commands vianpxfor skill updates. It also provides recipes and instructions for the agent to executeffmpegandpythonCLI commands to perform local media operations like concatenation and audio overlay. - [EXTERNAL_DOWNLOADS]: The skill downloads generated video files from the vendor's official API endpoints (
dashscope-intl.aliyuncs.com). It also instructs the agent to download themoviepylibrary from the official Python Package Index (PyPI) when local media processing is required. - [DATA_EXFILTRATION]: The skill is designed to upload user-provided local media (images, audio, and video) to the vendor's cloud storage (DashScope OSS) to facilitate video generation. This behavior is the intended primary purpose of the skill and is clearly documented for the user.
- [SAFE]: The skill implements robust security measures for handling API keys, including automated masking (
mask_keyinqwencloud_lib.py) and explicit warnings against hardcoding credentials. All remote resources and update instructions point to trusted vendor-managed infrastructure (QwenCloud).
Audit Metadata