hunyuan-image

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the official @cloudbase/node-sdk from the public NPM registry upon its first execution. This dependency is installed locally within the user's home directory (/.hunyuan/sdk) to facilitate communication with Tencent Cloud services.- [COMMAND_EXECUTION]: The generate.mjs script executes the npm install command via spawnSync to automatically provision its required SDK if it is not already available in the environment.- [DYNAMIC_EXECUTION]: The skill employs dynamic loading to import the @cloudbase/node-sdk library from a computed local path using createRequire after the package has been installed.- [CREDENTIALS_UNSAFE]: The skill requires Tencent Cloud API credentials (SecretId and SecretKey) to function. It follows security best practices by instructing the user to store these sensitive values in a local configuration file (/.hunyuan/config.env) with restricted file system permissions (chmod 600) rather than hardcoding them.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 12:21 PM
Security Audit — agent-trust-hub — hunyuan-image