image-fetcher

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the Python requests library to fetch image data from user-provided URLs. It implements a 30-second timeout and custom User-Agent header to ensure reliable network operations. These downloads are integral to the stated purpose of the skill.
  • [COMMAND_EXECUTION]: The documentation provides instructions for executing the Python scripts via the CLI (e.g., python scripts/fetch_image.py <url>). These commands are standard for script usage and do not involve shell injection or dangerous elevation of privilege.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data (images and URLs), which presents a theoretical attack surface for indirect injection. However, the current implementation only performs binary writes of image data and does not feed the content back into the LLM context in a way that would trigger command obedience, effectively mitigating this risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 03:44 AM