media-router
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands like
findto locate user media files in standard directories (~/Downloads,~/Desktop,~/Pictures) andmkdirto manage output folders. These actions are strictly scoped to the skill's media processing tasks. - [EXTERNAL_DOWNLOADS]: The skill employs
curlto upload assets to URLs generated by the Arcads MCP and to download resulting media files. Security is managed by an explicit instruction to never execute or open downloaded files via the shell, treating them as data only. - [INDIRECT_PROMPT_INJECTION]: The skill functions as a router for user prompts and media files. While it lacks explicit boundary markers for these inputs, its role is primarily to map user intent to specific tool parameters, limiting the impact of potentially malicious data embedded in media.
- [DYNAMIC_EXECUTION]: The skill dynamically discovers the Arcads tool catalog at runtime through MCP introspection. This avoids hardcoding tool names and ensures compatibility with the latest version of the MCP server.
Audit Metadata