Crun Agent Skills

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:23 AM UTC
• Version: 1.0.0

Overview

This is a coherent Crun media-generation skill, but it handles API credentials and external network inputs too broadly for automatic installation without review.

Review before installing. Use only the official Crun API endpoint unless you intentionally trust another endpoint, protect or avoid the persistent ~/.crun/.env API-key file, confirm every credit-spending task, avoid running URL-based promo workflows on internal/private URLs, and watch result downloads from untrusted or custom endpoints.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: runtime/crun_cli.py:199

Finding

API Key Disclosure Through Arbitrary and Insecure API Endpoints

Content

View full analysis

Any: url = f"{self.base_url}{path}" if query: filtered = {key: value for key, value in query.items() if value is not None} if filtered: url = f"{url}?{urlencode(filtered)}" data = json.dumps(body).encode("utf-8") if body is not None else None request = Request( url, data=data, method=method, headers={ "Accept": "application/json", "Content-Type": "application/json", "X-API-KEY": self.api_key, "User-Agent": "crun-agent-skills/1", }, ) attempts = self.request_retries ...[truncated 2607 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: runtime/crun_cli.py:140

Finding

Plaintext API Key Persistence Without Enforced Restrictive Permissions

Content

View full analysis

dict[str, Any]: """Validate the key and persist it into ~/.crun/.env (create or replace).""" api_key = validate_api_key(api_key, "config set-api-key argument") key_line = f"{API_KEY_ENV}={api_key}" lines: list[str] = [] try: lines = HOME_ENV_FILE.read_text(encoding="utf-8-sig").splitlines() except FileNotFoundError: pass except OSError as exc: raise CrunError(f"Cannot read API key configuration file: {HOME_ENV_FILE}") from exc replaced = False for index, raw_line in enumerate(lines): stripped = raw_line.strip() if stripped.startswith("export "): stripped = stripped[7:].lstrip() if stripped.partition("=")[0].strip() == API_KEY_ENV: lines[index] = key_line replaced = True if not replaced: lines.append(key_line) try: HOME_ENV_FILE.parent.mkdir(parents=True, exist_ok=True) HOME_ENV_FILE.write_text("\n".join(lines) + "\n", encoding="utf-8") except OSError as exc: raise CrunError(f"Cannot write API key configuration file: {HOME_ENV_FILE}") from exc ``` The key is also accepted as a positional command-line argument: ```python set_key = config_sub.add_parser( "set-api-key", help="Validate and persist the API key into ~/.crun/.env" ) set_key.add_argument( "api_key", help="Crun API key ('ak_' followed by 32 characters)" ) ``` On POSIX systems, the resulting file mode depends on the user's current `umask`. A permissive `um ...[truncated 1625 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: ` to obtain a Crun `file_url` for image-edit (I2I) or image-to-video (I2V) workflows. 2. **Fallback for Inaccessible URLs**: If fetching the URL directly fails (e.g., anti-scraping or paywall), ask the user for a quick text snippet, screenshot, or product image, and proceed seamlessly without halting the workflow. ``` If the hosting agent's browsing tools can access internal addresses, a malicious user can use this workflow to probe loopback services, cloud metadata endpoints, private network applicati ...[truncated 1741 chars]:59

Finding

Unrestricted URL Retrieval in the Promotional Media Workflow

Content

View full analysis

` to obtain a Crun `file_url` for image-edit (I2I) or image-to-video (I2V) workflows. 2. **Fallback for Inaccessible URLs**: If fetching the URL directly fails (e.g., anti-scraping or paywall), ask the user for a quick text snippet, screenshot, or product image, and proceed seamlessly without halting the workflow. ``` If the hosting agent's browsing tools can access internal addresses, a malicious user can use this workflow to probe loopback services, cloud metadata endpoints, private network applications, or local administrative interfaces. The subsequent instruction to fetch and upload page images compounds the risk: material obtained from a private destination could be sent to Crun's ext ...[truncated 1396 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: runtime/crun_cli.py:443

Finding

Unbounded Downloads From Untrusted Task Result URLs

Content

View full analysis

dict[str, Any]: task_id = str(task.get("task_id") or "unknown-task") task_dir = output_dir.expanduser().resolve() / task_id local_media_paths: list[str] = [] download_errors: list[dict[str, str]] = [] for index, media_url in enumerate(task.get("media_urls") or [], start=1): if not isinstance(media_url, str): download_errors.append({"media_url": str(media_url), "error": "media URL is not a string"}) continue parsed = urlsplit(media_url) if parsed.scheme not in {"http", "https"}: download_errors.append({"media_url": media_url, "error": "media URL is not HTTP(S)"}) continue suffix = Path(parsed.path).suffix or ".bin" target = task_dir / f"{index:02d}{suffix}" temporary = target.with_suffix(f"{target.suffix}.part") try: task_dir.mkdir(parents=True, exist_ok=True) request = Request(media_url, headers={"User-Agent": "crun-agent-skills/1"}) with urlopen(request, timeout=30.0) as response, temporary.open("wb") as destination: while chunk := response.read(CHUNK_SIZE): destination.write(chunk) temporary.replace(target) local_media_paths.append(str(target)) except (OSError, HTTPError, URLError, TimeoutError, ValueError) as exc: temporary.unlink(missing_ok=True) download_errors.append({"media_url": media_url, "error": str(exc)} ...[truncated 1955 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (84)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 1)May include surrounding context.

text

.env
__pycache__/
*.pyc
.idea

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a general-purpose media workflow runner built around a bundled Crun runtime and capable of handling many media modalities plus orchestration tasks. The supplied code does none of that. It only processes local image files using PIL, computes a grid layout, renders text overlays, and writes a stitched comic image to disk. While this loosely falls under image transformation, the actual code's primary purpose is materially narrower and does not implement the core declared capabilities such as runtime/model execution, multi-modal processing, uploads/downloads, async execution, or inspection/estimation features.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a comprehensive multi-modal Crun runtime skill covering many media-generation and orchestration capabilities. The supplied code chunk does not implement that general runtime behavior. Instead, it performs one specific local image-editing task: adding text overlays to an existing static image using PIL. It does not invoke Crun, route models, inspect schemas, estimate credits, upload media, run async jobs, download generated outputs, preview media inline, or handle video/audio/music. While the code is loosely related to image transformation, the declared purpose materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a general-purpose Crun media orchestration skill spanning many media types and runtime-management capabilities. This code chunk instead implements a specific local post-processing tool for turning a video into a GIF meme with optional text captions. That is related to media transformation, but it is materially narrower and lacks the core declared behaviors around Crun runtime usage and multi-modal workflow support. Therefore the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger description is extremely broad, instructing invocation whenever the user wants almost any image, video, audio, speech, or music operation, even if they never mention Crun. Over-broad routing can cause unintended activation of a high-capability skill, increasing the chance of unnecessary file uploads, external network actions, or charged task execution in contexts where a narrower skill would be safer.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

- `catalog/models.json` is the local routing catalog.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

relevant child `SKILL.md` before performing that part of the workflow.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/crun_cli.py (reported line 50)May include surrounding context.

python

DEFAULT_CATALOG = Path(__file__).resolve().parent.parent / "catalog" / "models.json"
DEFAULT_OUTPUT_DIR = Path.home() / ".crun" / "output" / date.today().strftime("%Y-%m-%d")
CLI_SCRIPT_PATH = Path(__file__).resolve()
HOME_ENV_FILE = Path.home() / ".crun" / ".env"


class CrunError(RuntimeError):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/crun_cli.py (reported line 630)May include surrounding context.

python

DEFAULT_CATALOG = Path(__file__).resolve().parent.parent / "catalog" / "models.json"
DEFAULT_OUTPUT_DIR = Path.home() / ".crun" / "output" / date.today().strftime("%Y-%m-%d")
CLI_SCRIPT_PATH = Path(__file__).resolve()
HOME_ENV_FILE = Path.home() / ".crun" / ".env"


class CrunError(RuntimeError):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · runtime/crun_cli.py (reported line 64)May include surrounding context.

python

def read_dotenv_value(path: Path, name: str) -> Optional[str]:
    """Read one value from a .env file without external dependencies."""
    try:
        lines = path.read_text(encoding="utf-8-sig").splitlines()
    except FileNotFoundError:

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · runtime/crun_cli.py (reported line 128)May include surrounding context.

python

,
            "recommended": True,
            "commands": {
                "macos_linux": cli_command,
                "windows_cmd": cli_command,
                "windows_powershell": cli_command,
            },
        },
        {
            "method": "environment_variable",
            "location": API_KEY_ENV,
            "commands": {
                "macos_linux": (
                    f"echo 'export {API_KEY_ENV}=<your_api_key>' >> ~/.bashrc"
                    "   # use ~/.zshrc on macOS zsh; open a new terminal to apply"
                ),
                "windows_cmd": f"setx {API_KEY_ENV} <your_api_key>",
                "windows_powershell": (
                    f"[Environment]::SetEnvironmentVariable('{API_KEY_ENV}','<your_api_key>','User')"
                ),
            },
        },
    ]


def set_api_key(api_key: str) -> dict[str, Any]:
    """Validate the key and persist it into ~/.crun/.env (create or replace)."""
    api_key = validate_api_key(api_key, "config

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

This code stores the API key in plaintext in ~/.crun/.env, creating a recoverable local credential artifact. If another local user, backup system, malware, or overly permissive file permissions expose that file, the API key can be stolen and abused for account access and billable operations.

Content

Scanner excerpt · runtime/crun_cli.py (reported line 141)May include surrounding context.

python

def set_api_key(api_key: str) -> dict[str, Any]:
    """Validate the key and persist it into ~/.crun/.env (create or replace)."""
    api_key = validate_api_key(api_key, "config set-api-key argument")
    key_line = f"{API_KEY_ENV}={api_key}"

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger is extremely broad and instructs activation for many generic art-related phrases even when the user never mentions Crun or this specific workflow. Overbroad activation can cause the wrong skill to take control, leading to unintended external actions, unnecessary credit-spending flows, or bypass of more appropriate narrower skills.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger description is extremely broad and can activate on many generic requests involving topics, stories, historical events, coding logic, or explanations even when the user did not ask for a comic workflow. Over-broad routing can cause unintended tool use, unnecessary file/task operations, and surprise generation behavior, especially in agent systems that auto-select skills from descriptions.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger language is extremely broad and is designed to activate on generic 'URL to media' requests, even when the user does not explicitly invoke Crun. That can cause unintended routing of ordinary browsing or content-transformation requests into a credit-spending, external-media workflow, increasing the risk of surprise actions, unnecessary data handling, and accidental execution of powerful downstream capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

该文件整体以中文编写且文件名明确为中文版本，面向用户的安装与使用说明默认采用中文，没有在文内提供语言偏好选择或说明仅适用于中文用户。根据规则，强制特定语言而无用户选择可能构成自然语言政策问题。

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users/agents to run npx skills add CrunTeam/crun-agent-skills --all without pinning a specific package version or commit. This creates a supply-chain risk: a future compromised or maliciously replaced package version could be fetched and executed automatically, which is more dangerous in an agent-skill context because installation is presented as a copy-paste command for automation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This command again uses npx skills add without an explicit version pin, allowing the resolved package/tooling to drift over time. If the upstream package or dependency chain is compromised, users or agents following the README could install and execute attacker-controlled code during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The --all installation example relies on unpinned npx skills, so the fetched installer/tool may change between runs and environments. In a skill ecosystem, this increases exposure to remote package hijacking or malicious updates because installation is likely to be delegated to an automated agent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The global install example also references npx skills without pinning, so it inherits the same supply-chain execution risk while potentially affecting a broader user scope via global installation. A compromised upstream package here could lead to persistent malicious tooling on the host.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README-zh.md (reported line 226)May include surrounding context.

md

路由候选来自 [`catalog/models.json`](./catalog/models.json)——本地模型目录，收录 138
个模型的模态、支持的操作、质量/速度档位、参考素材支持、原生音频支持和路由优先级；`models list` 还可以直接调取远程的最新模型列表。概览：

| 模态    | 模型家族                                                                                                                                                        | 操作                                                                                                                   |
|-------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| 图片    | Seedream 5/4.5/4、GPT-Image 2/1.5/1、Nano Banana / Pro / 2、FLUX 1.1/2/Kontext、Qwen-Image 2.0、Wan 2.6/2.7 Image、Grok Imagine、z-image                           | `text-to-image`、`image-edit`                                                                                         |
| 视频    | Seedance 2.0/1.5/1.0、Sora 2 / Sora 2 Pro、Veo 3.1（fast/lite/quality）、Kling v2.x/v3、Vidu Q1–Q3、Wan 2.5–2.7、Hailuo、Runway Gen-4、HappyHorse 1.0/1.1、Gemini Omni | `text-to-video`、`image-to-video`、`reference-to-video`、`first-last-frame-to-video`、`storyboard-to-video`、`video-edit` |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 238)May include surrounding context.

md

路由候选来自 [`catalog/models.json`](./catalog/models.json)——本地模型目录，收录 138
个模型的模态、支持的操作、质量/速度档位、参考素材支持、原生音频支持和路由优先级；`models list` 还可以直接调取远程的最新模型列表。概览：

| 模态    | 模型家族                                                                                                                                                        | 操作                                                                                                                   |
|-------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| 图片    | Seedream 5/4.5/4、GPT-Image 2/1.5/1、Nano Banana / Pro / 2、FLUX 1.1/2/Kontext、Qwen-Image 2.0、Wan 2.6/2.7 Image、Grok Imagine、z-image                           | `text-to-image`、`image-edit`                                                                                         |
| 视频    | Seedance 2.0/1.5/1.0、Sora 2 / Sora 2 Pro、Veo 3.1（fast/lite/quality）、Kling v2.x/v3、Vidu Q1–Q3、Wan 2.5–2.7、Hailuo、Runway Gen-4、HappyHorse 1.0/1.1、Gemini Omni | `text-to-video`、`image-to-video`、`reference-to-video`、`first-last-frame-to-video`、`storyboard-to-video`、`video-edit` |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README-zh.md (reported line 226)May include surrounding context.

md

路由候选来自 [`catalog/models.json`](./catalog/models.json)——本地模型目录，收录 138
个模型的模态、支持的操作、质量/速度档位、参考素材支持、原生音频支持和路由优先级；`models list` 还可以直接调取远程的最新模型列表。概览：

| 模态    | 模型家族                                                                                                                                                        | 操作                                                                                                                   |
|-------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| 图片    | Seedream 5/4.5/4、GPT-Image 2/1.5/1、Nano Banana / Pro / 2、FLUX 1.1/2/Kontext、Qwen-Image 2.0、Wan 2.6/2.7 Image、Grok Imagine、z-image                           | `text-to-image`、`image-edit`                                                                                         |
| 视频    | Seedance 2.0/1.5/1.0、Sora 2 / Sora 2 Pro、Veo 3.1（fast/lite/quality）、Kling v2.x/v3、Vidu Q1–Q3、Wan 2.5–2.7、Hailuo、Runway Gen-4、HappyHorse 1.0/1.1、Gemini Omni | `text-to-video`、`image-to-video`、`reference-to-video`、`first-last-frame-to-video`、`storyboard-to-video`、`video-edit` |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README-zh.md (reported line 228)May include surrounding context.

md

| 模态    | 模型家族                                                                                                                                                        | 操作                                                                                                                   |
|-------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| 图片    | Seedream 5/4.5/4、GPT-Image 2/1.5/1、Nano Banana / Pro / 2、FLUX 1.1/2/Kontext、Qwen-Image 2.0、Wan 2.6/2.7 Image、Grok Imagine、z-image                           | `text-to-image`、`image-edit`                                                                                         |
| 视频    | Seedance 2.0/1.5/1.0、Sora 2 / Sora 2 Pro、Veo 3.1（fast/lite/quality）、Kling v2.x/v3、Vidu Q1–Q3、Wan 2.5–2.7、Hailuo、Runway Gen-4、HappyHorse 1.0/1.1、Gemini Omni | `text-to-video`、`image-to-video`、`reference-to-video`、`first-last-frame-to-video`、`storyboard-to-video`、`video-edit` |
| 音频与音乐 | Qwen3-TTS（语音合成、声音克隆、音色设计）、Suno（音乐生成/翻唱/续写、音效、人声分离）                                                                                                          | `text-to-speech`、`music-generate`、`sound-effects`、`vocal-separation`                                                 |
| 媒体工具  | 图片超分、背景移除、水印移除、视频增强、口型同步（Vidu）、动作控制（Kling、DreamActor、Wan Animate）、视频模板                                                                                      | `image-upscale`、`background-remove`、`watermark-remove`、`lip-sync`、`motion-control`、`template-to-video`               |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README-zh.md (reported line 230)May include surrounding context.

md

|-------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| 图片    | Seedream 5/4.5/4、GPT-Image 2/1.5/1、Nano Banana / Pro / 2、FLUX 1.1/2/Kontext、Qwen-Image 2.0、Wan 2.6/2.7 Image、Grok Imagine、z-image                           | `text-to-image`、`image-edit`                                                                                         |
| 视频    | Seedance 2.0/1.5/1.0、Sora 2 / Sora 2 Pro、Veo 3.1（fast/lite/quality）、Kling v2.x/v3、Vidu Q1–Q3、Wan 2.5–2.7、Hailuo、Runway Gen-4、HappyHorse 1.0/1.1、Gemini Omni | `text-to-video`、`image-to-video`、`reference-to-video`、`first-last-frame-to-video`、`storyboard-to-video`、`video-edit` |
| 音频与音乐 | Qwen3-TTS（语音合成、声音克隆、音色设计）、Suno（音乐生成/翻唱/续写、音效、人声分离）                                                                                                          | `text-to-speech`、`music-generate`、`sound-effects`、`vocal-separation`                                                 |
| 媒体工具  | 图片超分、背景移除、水印移除、视频增强、口型同步（Vidu）、动作控制（Kling、DreamActor、Wan Animate）、视频模板                                                                                      | `image-upscale`、`background-remove`、`watermark-remove`、`lip-sync`、`motion-control`、`template-to-video`               |

本地目录只负责路由标签与优先级；某个模型当前的输入 schema 始终以鉴权后的 Models 接口为准（`models describe`）。