mediabunny
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation, type definitions, and API references from the official developer site
mediabunny.devand GitHub. These references are used to maintain up-to-date information about the library's capabilities and are considered trusted resources for this skill's primary purpose. - [INDIRECT_PROMPT_INJECTION]: The library provides the capability to extract metadata tags (such as title, comments, and lyrics) from media files. This creates an attack surface where instructions could be embedded in data processed by the agent. However, the library facilitates only the extraction of this data and includes no mechanisms for its automatic execution as commands.
- [REMOTE_CODE_EXECUTION]: The skill uses
@mediabunny/serverwhich depends onnode-avfor native FFmpeg bindings. While this involves binary execution for media processing, it is standard for high-performance transcoding tasks and follows the expected behavior of a media library.
Audit Metadata