cloudinary
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses Ruby's standard library to interact with the Cloudinary REST API, avoiding external or untrusted dependencies.
- [CREDENTIALS_SAFE]: The skill prompts the user for their Cloudinary Cloud Name, API Key, and API Secret. These are stored locally in
~/.config/cloudinary/with restricted file permissions (mode 0600), following standard security practices for secret management. - [COMMAND_EXECUTION]: The skill executes local Ruby scripts to perform API operations. Potentially destructive operations, such as asset deletion or new uploads, are explicitly designed to require user confirmation within the instructional flow.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it displays data (such as image public IDs and folder names) retrieved from the external Cloudinary API. However, the risk is mitigated by the requirement for user confirmation before executing state-changing actions based on that data.
Audit Metadata