hunyuan-image
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the official
@cloudbase/node-sdkfrom the public NPM registry upon its first execution. This dependency is installed locally within the user's home directory (/.hunyuan/sdk) to facilitate communication with Tencent Cloud services.- [COMMAND_EXECUTION]: The generate.mjs script executes the npm install command via spawnSync to automatically provision its required SDK if it is not already available in the environment.- [DYNAMIC_EXECUTION]: The skill employs dynamic loading to import the/.hunyuan/config.env) with restricted file system permissions (chmod 600) rather than hardcoding them.@cloudbase/node-sdklibrary from a computed local path using createRequire after the package has been installed.- [CREDENTIALS_UNSAFE]: The skill requires Tencent Cloud API credentials (SecretId and SecretKey) to function. It follows security best practices by instructing the user to store these sensitive values in a local configuration file (
Audit Metadata