connector-tmdb
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process metadata from a third-party API (The Movie Database), which serves as an untrusted data source that could contain malicious instructions.
- Ingestion points: External data enters the agent context through the search and detail retrieval functions defined in
src/backend/main.mo(e.g.,Tmdb.searchMovie,Tmdb.movieDetails). - Boundary markers: The skill does not implement delimiters or provide explicit instructions to the agent to disregard any commands potentially embedded in the movie titles or overviews.
- Capability inventory: The skill facilitates outbound HTTPS network requests to the TMDb API and processes the structured response for display.
- Sanitization: While the code in
src/backend/main.mohandles null values and basic type mapping via thetoMoviefunction, it does not perform sanitization, escaping, or filtering of the text content retrieved from the API.
Audit Metadata