dreamina-cli
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
README.mdprovides installation instructions using the commandcurl -fsSL https://jimeng.jianying.com/cli | bash. This executes a remote shell script from the official domain of a well-known service (Dreamina/Jianying, owned by ByteDance). - [COMMAND_EXECUTION]: The central logic in
scripts/dreamina_wrapper.pyuses thesubprocess.runfunction to invoke thedreaminaCLI binary. The command is executed as a list of strings, which is a secure practice to prevent shell injection. While the binary path is configurable via the--dreamina-binargument, this is a standard design pattern for CLI wrappers. - [EXTERNAL_DOWNLOADS]: The skill relies on the external
dreaminaCLI tool, which is downloaded during the setup process as documented in the README.
Audit Metadata