media-cloud-upload
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system commands via
subprocess.runto interact with established CLI tools likecurl,aws, andrclone. These operations are conducted using list-based arguments rather than shell strings, which effectively prevents command injection vulnerabilities from user-supplied file names or metadata. - [EXTERNAL_DOWNLOADS]: The documentation references well-known and official packages for installation, such as
google-api-python-client,awscli, andPyVimeo. These are standard dependencies for the cloud services the skill is designed to support. - [CREDENTIALS_UNSAFE]: Secret management follows industry standards. The skill instructs users to utilize environment variables for API tokens and rely on existing tool configurations (e.g.,
~/.aws/credentialsor~/.config/rclone) rather than hardcoding credentials. The included script verifies the presence of these variables without exposing their values.
Audit Metadata