exiftool
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently invokes shell commands to execute
exiftoolfor reading, editing, and stripping metadata from files. It also uses standard utilities likefile,mediainfo, andgrepfor file analysis and output filtering. - [EXTERNAL_DOWNLOADS]: The provided installation scripts (
scripts/install.shandscripts/install.ps1) utilize official system package managers, including Homebrew, APT, DNF, Pacman, and APK, to download and install theexiftoolbinary from trusted platform repositories. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting and displaying untrusted data from external file metadata.
- Ingestion points: Metadata extraction via
exiftool <file>as described inSKILL.mdandreferences/advanced-usage.md. - Boundary markers: None; metadata values are presented directly to the agent without delimiters or warnings to ignore embedded instructions.
- Capability inventory: The skill has the ability to read and write to the file system and execute shell commands via
exiftooland system package managers. - Sanitization: There is no evidence of sanitization or validation of the extracted metadata before it is processed by the agent.
Audit Metadata