happy-horse-short-drama-video
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a CLI script
scripts/videogen.pythat handles interaction with the AI Hive OpenAPI. It performs expected tasks such as uploading media, submitting generation jobs, and polling for results. - [EXTERNAL_DOWNLOADS]: The script downloads generated video and image files from the AI Hive service (ai-hive.iclip.cn) directly to the user's Downloads directory.
- [DATA_EXFILTRATION]: The skill uploads user-provided media files to the vendor's API. This behavior is transparent and necessary for the tool's primary purpose. It also secures its configuration file with appropriate file permissions (0600).
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and media paths which are forwarded to the API. While this creates a potential attack surface for indirect injection, the risk is inherent to the tool's function and managed by the AI service's backend. • Ingestion points: Command-line arguments for prompts and media file paths in
scripts/videogen.py. • Boundary markers: None identified in the prompt construction logic. • Capability inventory: File system access (read/write) and network operations via therequestslibrary. • Sanitization: No sanitization is performed on user inputs before transmission to the API.
Audit Metadata