web-media-getter
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading image, video, and GIF files from external sources (such as NASA, Pexels, and Pixabay) to a user-specified local directory.
- [DATA_EXFILTRATION]: User search queries are transmitted to third-party API providers (e.g., Openverse, Internet Archive, Wikimedia) to retrieve media metadata and download links as part of the tool's core functionality.
- [PROMPT_INJECTION]: The skill processes untrusted metadata (titles, descriptions, licenses) from external web APIs. While it implements standard quoting for queries, the ingestion of external data creates an indirect prompt injection surface typical for retrieval-based tools.
- [REMOTE_CODE_EXECUTION]: Documentation in the README includes instructions for users to download and execute the tool's main Python script directly from its GitHub repository.
- [COMMAND_EXECUTION]: The skill is implemented as a standalone Python CLI tool (
webmedia.py) that the agent is instructed to execute to perform media retrieval tasks. - [SAFE]: The script uses robust filename sanitization (
_safe_name) to prevent directory traversal attacks during downloads and correctly uses environment variables for API key management.
Audit Metadata