alicloud-ai-video-wan-video
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The scripts
generate_video.pyandgenerate_dancing_video.pyare designed to read authentication credentials from standard locations, including environment variables,.envfiles, and the~/.alibabacloud/credentialsfile. This behavior is consistent with the primary purpose of the skill to interface with Alibaba Cloud services. - [EXTERNAL_DOWNLOADS]: The skill utilizes
urllib.requestto download generated video and image files from URLs returned by the Alibaba Cloud DashScope API. These downloads are performed to save the output of the generation process to the local file system. - [COMMAND_EXECUTION]: The skill provides Python scripts that execute network requests to the DashScope API and perform file system operations to save generated media. These scripts are intended to be invoked by the agent to fulfill video generation requests.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied strings as prompts for image and video generation, which are then passed to the DashScope SDK.
- Ingestion points: The
--promptcommand-line argument and--requestJSON inputs in the provided Python scripts. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are included in the prompt construction.
- Capability inventory: The scripts have the capability to write files to the local disk and perform network operations via the
dashscopeSDK andurllib.request. - Sanitization: Input prompts are passed to the remote API without local sanitization or filtering.
Audit Metadata