media-info
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs HTTP GET and POST requests to
60s.viki.moeto retrieve music and movie metadata. - Evidence: API calls to
https://60s.viki.moe/v2/ncm-rank/list,https://60s.viki.moe/v2/lyric, andhttps://60s.viki.moe/v2/maoyan/realtime/movie. - [COMMAND_EXECUTION]: The skill documentation includes Python code snippets designed to be executed by the agent to interact with the entertainment APIs.
- Evidence: Python scripts using the
requestslibrary to parse JSON responses and display entertainment data. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface by ingesting untrusted external data (such as song lyrics or movie titles) into the agent's context.
- Ingestion points: JSON responses from the music and movie API endpoints.
- Boundary markers: None present in the provided examples.
- Capability inventory: The skill is limited to performing network requests and text processing.
- Sanitization: No explicit filtering or sanitization of API content is shown in the examples.
Audit Metadata