qwen-mm-plugins-omni-chatcut-music-to-mv
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The script
workflows/video-generation/scripts/run_mv_pipeline.pyutilizesimportlib.import_moduleto dynamically load the main pipeline logic fromqwen_mm_plugins_omni_chatcut.music_to_mv.pipeline. This serves as a portable launcher for the packaged implementation. - [COMMAND_EXECUTION]: Several components of the skill execute shell commands using the
subprocessmodule to interact with media tools and cloud CLIs. workflows/video-generation/scripts/burn_lyrics_subtitles.pyinvokesffmpegandffprobefor subtitle rendering and media validation.workflows/video-generation/references/api-and-rate-limits.mddocuments the use of thedashscopeCLI for uploading assets to object storage.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user-provided content (briefs) and processes audio analysis results, which are subsequently used to construct prompts for remote generative models.
- Ingestion points:
SKILL.md(user briefs) andworkflows/music-caption/WORKFLOW.md(music analysis evidence). - Sanitization: The workflow implements extensive validation through scripts like
validate_storyboard.pyandvalidate_execution_storyboard.py, and enforces a rigid JSON contract (music-caption-evidence) to prevent malformed data from affecting downstream model calls. - Capability inventory: Includes shell command execution and authenticated network requests via MCP tools.
- [EXTERNAL_DOWNLOADS]: The skill communicates with external endpoints for media generation and processing.
- It fetches configuration and assets from
dashscope.aliyuncs.com(Alibaba Cloud) andark.cn-beijing.volces.com(Volcengine). These are established and well-known technology services.
Audit Metadata