happy-horse
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits user-provided media files and an API key to the external domain
ai-hive.iclip.cn. It also uses thewebbrowsermodule to open external URLs for user onboarding. - [EXTERNAL_DOWNLOADS]: The script downloads generated video files from remote result URLs provided by the AI Hive API to the local file system.
- [PROMPT_INJECTION]: The skill ingests untrusted prompt strings and media from users to be processed by an external AI service, creating a surface for indirect prompt injection attacks. 1. Ingestion points: CLI arguments
--prompt,--image,--video,--audio,--first-frame, and--last-frameinscripts/videogen.py. 2. Boundary markers: None detected; prompts are interpolated directly into API request bodies. 3. Capability inventory: File system read/write access and network communication withai-hive.iclip.cn. 4. Sanitization: None; input strings are not sanitized or escaped before transmission.
Audit Metadata