asset-import
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
download_mediatool to fetch external media files from public URLs provided by the user. This is a standard functional requirement for importing web-based assets. - [PROMPT_INJECTION]: The skill ingests untrusted data from external sources (media URLs) which presents a surface for indirect prompt injection through file metadata or content. However, there is no evidence of malicious intent or exploitation.
- Ingestion points: Public media URLs retrieved via the
download_mediatool. - Boundary markers: No specific delimiters or warnings for the agent regarding the content of downloaded media are present.
- Capability inventory: The skill has access to
download_media,import_media, andedit_itemtools. - Sanitization: No mention of sanitization for metadata or content of the imported assets.
Audit Metadata