blink-skill
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements security best practices for handling sensitive Blink account credentials, including setting file permissions to 0o600 for the credentials.json file.
- [SAFE]: The local sidecar API provided by sidecar.py is restricted to the loopback interface (127.0.0.1), preventing unauthorized external access to camera controls.
- [SAFE]: The media server includes path traversal protections and strictly confines file access to designated snapshots and video directories.
- [EXTERNAL_DOWNLOADS]: The skill depends on the blinkpy and aiohttp libraries for managing communications with the official Blink cloud API.
- [COMMAND_EXECUTION]: The skill provides a command-line interface for common camera operations like arming, disarming, and capturing snapshots.
- [SAFE]: The skill ingests camera and network names from the Blink cloud API; however, it employs sanitization and robust path validation when using these strings for file operations, mitigating risks of indirect prompt injection or path traversal.
Audit Metadata