image-fetcher
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the Python
requestslibrary to fetch image data from user-provided URLs. It implements a 30-second timeout and custom User-Agent header to ensure reliable network operations. These downloads are integral to the stated purpose of the skill. - [COMMAND_EXECUTION]: The documentation provides instructions for executing the Python scripts via the CLI (e.g.,
python scripts/fetch_image.py <url>). These commands are standard for script usage and do not involve shell injection or dangerous elevation of privilege. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (images and URLs), which presents a theoretical attack surface for indirect injection. However, the current implementation only performs binary writes of image data and does not feed the content back into the LLM context in a way that would trigger command obedience, effectively mitigating this risk.
Audit Metadata