unsplash-image-search-download
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads image data and API metadata from Unsplash. These operations target a well-known service and are central to the skill's documented purpose.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by processing external data from the Unsplash API and user-provided search queries.
- Ingestion points: User-provided search query via the
--queryargument and JSON responses fetched fromapi.unsplash.com. - Boundary markers: None present; the script does not use specific delimiters or instructions to the agent to disregard potential commands within the retrieved metadata.
- Capability inventory: The skill performs network GET requests to fetch images and metadata, and writes binary data to the local file system.
- Sanitization: The script uses a
slugifyfunction to strip non-alphanumeric characters from search terms used in filenames and employsurllib.parse.urlencodefor constructing API request URLs.
Audit Metadata