The Agent Skills Directory

[SAFE]: No malicious patterns, obfuscation, or unauthorized data access were detected. The skill's behavior is consistent with its stated purpose of editing and viewing photo and video metadata.
[COMMAND_EXECUTION]: The script scripts/exif.py executes the exiftool binary using subprocess.run with a sequence of arguments and shell=False. This is the recommended secure approach to avoid shell injection vulnerabilities, ensuring that user-provided inputs are treated strictly as data.
[EXTERNAL_DOWNLOADS]: The installation instructions recommend using official and trusted system package registries, such as Homebrew for macOS and APT for Debian/Ubuntu, to install the exiftool dependency.
[PROMPT_INJECTION]: The skill processes metadata from untrusted media files, which represents an indirect prompt injection surface.
Ingestion points: Metadata output extracted by exiftool and processed in scripts/exif.py.
Boundary markers: The current implementation does not use explicit delimiters to separate metadata values from instructional context.
Capability inventory: The skill has the ability to write to the local filesystem (renaming files, creating sidecars) and execute the exiftool binary via subprocess.
Sanitization: No specific filtering or sanitization is applied to the metadata content before it is presented to the agent.

media-exiftool