web-ready
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several external binaries (exiftool, vipsthumbnail, avifenc, cwebp) to perform image transformations. Instructions demonstrate the use of double-quoting for shell arguments to mitigate injection risks.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted image data. * Ingestion points: Input directory (SKILL.md). * Boundary markers: Absent. * Capability inventory: File processing via exiftool, vipsthumbnail, avifenc, and cwebp (SKILL.md). * Sanitization: Relies on shell argument quoting and standard tool validation.
- [SAFE]: No obfuscation, persistence, or data exfiltration mechanisms were identified. The primary function of stripping EXIF data enhances user privacy.
Audit Metadata