video-script
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill makes network requests to
api.xiaomimimo.comand associated regional clusters to interact with AI models for video understanding and review. These operations transmit video analysis data and scripts to the provider's API. This activity is essential to the skill's function and uses environment-based authentication.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from video analysis files and ASR transcripts. This creates a surface for indirect prompt injection if the content contains adversarial instructions. The skill lacks formal boundary markers or sanitization processes for this interpolated data.\n - Ingestion points:
vlm_analysis.json,asr_result.json,background_research.json.\n - Boundary markers: Absent for interpolated content.\n
- Capability inventory: Network requests (urllib) and file system writes.\n
- Sanitization: None detected.\n- [DYNAMIC_EXECUTION]: Multiple scripts within the skill folder utilize
importlibto dynamically load and execute the localdeslop_qc.pymodule. This is used for internal code organization and is limited to static, local file paths.
Audit Metadata