kuaishou-video
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
child_process.spawnandspawnSyncto execute theego-browsercommand-line tool andnodescripts. This is the primary mechanism for controlling the automated browser environment. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-supplied video descriptions and comment text. These inputs are typed directly into the web interface of the creator platform. While this represents a standard data ingestion surface, it technically allows for instructions to be passed to the target platform's UI.
- Ingestion points: Arguments passed to
publish.sh(description) andcomment.sh(comment text), which are stored in/tmp/kuaishou-video-publish.jsonand/tmp/kuaishou-video-comment.json. - Boundary markers: None identified for the description/comment text fields; they are inserted as-is using
document.execCommand('insertText', ...). - Capability inventory: File system read (size/existence), Browser automation (clicking, typing, uploading), and subprocess execution.
- Sanitization: Basic validation checks for empty strings and file existence are performed before processing.
- [DYNAMIC_EXECUTION]: The skill dynamically generates a temporary JavaScript entry file (
entry.mjs) to bridge the execution environment between the local shell and theego-browsertool. It also usespage.evaluateto execute scripts within the context of the browser page, which is standard for web automation tasks.
Audit Metadata