skills/danielrosehill/claude-image-production-plugin/transcode-jpeg-to-jxl-lossless/Gen Agent Trust Hub
transcode-jpeg-to-jxl-lossless
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands (find, du, wc, cjxl) to process files and uses a hardcoded temporary file path /tmp/jpegs.txt, which can be susceptible to race conditions or information disclosure.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates user-controlled directory paths directly into shell command strings without sanitization or escaping.
- Ingestion points: User-provided directory path and filenames of files within that directory.
- Boundary markers: None. The input is used directly in shell command construction.
- Capability inventory: Shell command execution for file finding, disk usage calculation, and image transcoding.
- Sanitization: None. There is no validation or escaping of user-provided paths or filenames.
Audit Metadata