The Agent Skills Directory

[COMMAND_EXECUTION]: The script embed.py and its test suite test_embed.py use subprocess.run to call the exiftool command-line utility. The implementation is highly secure, passing arguments as a list to prevent shell injection and utilizing the -- separator to stop exiftool from interpreting filenames as options.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from a JSON manifest to populate image metadata.
Ingestion points: The manifest.json file processed by embed.py.
Boundary markers: The structured JSON format naturally separates data fields; no explicit LLM boundary markers are needed as the data is passed to a CLI tool, not back into the prompt.
Capability inventory: File system operations (read/write) and shell command execution via subprocess.
Sanitization: The script includes a robust path traversal check using Path.resolve().relative_to(src_resolved) to ensure it only interacts with files inside the designated folder.
[SAFE]: The skill demonstrates excellent security hygiene by referencing the official exiftool.org for documentation and implementing defensive coding practices to handle external file paths and CLI arguments.

photo-metadata