archive-broll
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes metadata and media files from the Internet Archive (archive.org), which is a platform for user-contributed content.
- Ingestion points: The
scripts/archive-broll.mjsscript fetches JSON metadata and video file URLs from the archive.org API. - Boundary markers: The data is handled as structured JSON fields and media streams; no specific instruction-filtering delimiters are present, but the data is not passed back into an LLM prompt as text.
- Capability inventory: The skill uses
spawnSyncto executeffmpegandffprobefor video processing andfs.writeFileSyncto save files to the local system. - Sanitization: The implementation follows security best practices by using array-based subprocess execution (preventing shell injection) and strictly constructing download URLs using
encodeURIComponentto ensure they point only to the official archive.org domain.
Audit Metadata