image-crop
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx agent-media@latest to perform image cropping operations. This involves downloading and executing the agent-media package from the npm registry at runtime. This package provides the core functionality of the skill and is associated with the author's intended media tools.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts input from external URLs via the --in parameter. This creates an attack surface for indirect prompt injection if the agent processes content from untrusted sources. Evidence: 1. Ingestion points: The --in argument in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: The skill executes image cropping via a subprocess. 4. Sanitization: Absent. The risk is considered low because the capabilities are restricted to image manipulation using the Sharp library.
Audit Metadata