web-ready

Pass

Audited by Gen Agent Trust Hub on May 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes several external binaries (exiftool, vipsthumbnail, avifenc, cwebp) to perform image transformations. Instructions demonstrate the use of double-quoting for shell arguments to mitigate injection risks.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted image data. * Ingestion points: Input directory (SKILL.md). * Boundary markers: Absent. * Capability inventory: File processing via exiftool, vipsthumbnail, avifenc, and cwebp (SKILL.md). * Sanitization: Relies on shell argument quoting and standard tool validation.
  • [SAFE]: No obfuscation, persistence, or data exfiltration mechanisms were identified. The primary function of stripping EXIF data enhances user privacy.
Audit Metadata
Risk Level
SAFE
Analyzed
May 2, 2026, 07:54 PM
Security Audit — agent-trust-hub — web-ready