image-to-webp
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads images from user-provided URLs using standard libraries and facilitates the installation of the Pillow image processing library from the official package registry.
- [COMMAND_EXECUTION]: The agent executes a bundled Python script with user-supplied arguments to process images and save them to the local filesystem.
- [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes untrusted data from external sources. \n
- Ingestion points: Input provided via the
--urland--inputarguments to the processing script inscripts/process_image.py. \n - Boundary markers: None; the skill assumes inputs are binary image data. \n
- Capability inventory: The tool can read from the local filesystem, write optimized images to a target directory, and make network requests. \n
- Sanitization: Output filenames are generated using a slugify function to ensure they are safe for the filesystem, and the image library validates file integrity during processing.
Audit Metadata