discover-movies

Pass

Audited by Gen Agent Trust Hub on Mar 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The run.sh script installs the uv package manager via curl -LsSf https://astral.sh/uv/install.sh | sh. This is a well-known development tool from a reputable source.
  • [COMMAND_EXECUTION]: The skill utilizes uv run and bash to execute its CLI and sanity checks. These commands are necessary for the skill's operation and are restricted to its own scripts.
  • [DATA_EXFILTRATION]: The skill accesses movie consumption history from a local file at ~/.pi/consume-movie/registry.json. This data is used only for generating recommendations and is not exfiltrated to external domains.
  • [SAFE]: No obfuscation, prompt injection, or other malicious behaviors were identified. The TMDB API integration and environmental configuration follow security best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 17, 2026, 06:35 AM
Security Audit — agent-trust-hub — discover-movies