qwen-mm-plugins-omni-chatcut-music-to-mv

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The script workflows/video-generation/scripts/run_mv_pipeline.py utilizes importlib.import_module to dynamically load the main pipeline logic from qwen_mm_plugins_omni_chatcut.music_to_mv.pipeline. This serves as a portable launcher for the packaged implementation.
  • [COMMAND_EXECUTION]: Several components of the skill execute shell commands using the subprocess module to interact with media tools and cloud CLIs.
  • workflows/video-generation/scripts/burn_lyrics_subtitles.py invokes ffmpeg and ffprobe for subtitle rendering and media validation.
  • workflows/video-generation/references/api-and-rate-limits.md documents the use of the dashscope CLI for uploading assets to object storage.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user-provided content (briefs) and processes audio analysis results, which are subsequently used to construct prompts for remote generative models.
  • Ingestion points: SKILL.md (user briefs) and workflows/music-caption/WORKFLOW.md (music analysis evidence).
  • Sanitization: The workflow implements extensive validation through scripts like validate_storyboard.py and validate_execution_storyboard.py, and enforces a rigid JSON contract (music-caption-evidence) to prevent malformed data from affecting downstream model calls.
  • Capability inventory: Includes shell command execution and authenticated network requests via MCP tools.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with external endpoints for media generation and processing.
  • It fetches configuration and assets from dashscope.aliyuncs.com (Alibaba Cloud) and ark.cn-beijing.volces.com (Volcengine). These are established and well-known technology services.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 05:43 AM