remove-background-batch
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary function involves constructing and executing shell commands (specifically
quick-rmbg,GNU parallel, andxargs) against local files. - [COMMAND_EXECUTION]: There is a potential attack surface for command injection because the skill relies on filenames found in a user-provided directory to build shell arguments.
- Ingestion points: The agent reads a directory listing and glob patterns from the local file system (SKILL.md).
- Boundary markers: Absent; the instructions do not specify a way to distinguish data (filenames) from instructions if metacharacters are present.
- Capability inventory: The skill uses subprocess execution for processing and reporting (SKILL.md).
- Sanitization: While the procedure mentions using double quotes for variables (
"$file"), this may be insufficient to prevent injection in complex shell scenarios involvingparallelorxargsif filenames contain specific shell-interpreted sequences.
Audit Metadata