alicloud-ai-video-wan-video

Pass

Audited by Gen Agent Trust Hub on Mar 28, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE]: The scripts generate_video.py and generate_dancing_video.py are designed to read authentication credentials from standard locations, including environment variables, .env files, and the ~/.alibabacloud/credentials file. This behavior is consistent with the primary purpose of the skill to interface with Alibaba Cloud services.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes urllib.request to download generated video and image files from URLs returned by the Alibaba Cloud DashScope API. These downloads are performed to save the output of the generation process to the local file system.
  • [COMMAND_EXECUTION]: The skill provides Python scripts that execute network requests to the DashScope API and perform file system operations to save generated media. These scripts are intended to be invoked by the agent to fulfill video generation requests.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied strings as prompts for image and video generation, which are then passed to the DashScope SDK.
  • Ingestion points: The --prompt command-line argument and --request JSON inputs in the provided Python scripts.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are included in the prompt construction.
  • Capability inventory: The scripts have the capability to write files to the local disk and perform network operations via the dashscope SDK and urllib.request.
  • Sanitization: Input prompts are passed to the remote API without local sanitization or filtering.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 28, 2026, 10:26 AM