lov-migrate-camera-media
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Python
subprocessmodule to execute system commands necessary for media migration and diagnostics. This includes invokingdiskutilfor volume metadata retrieval,ioregfor USB link speed analysis, andsyncfor buffer flushing. It also callsffmpegandffprobeto verify media samples. These calls use list-based arguments and are restricted to validated paths. - [INDIRECT_PROMPT_INJECTION]: By processing files from external camera cards, the skill interacts with potentially untrusted data. This attack surface is mitigated by the
safe_relfunction, which prevents directory traversal attacks by rejecting relative paths containing.., absolute paths, or control characters. The skill also performs source snapshot comparisons to detect unexpected changes during transfer. - [EXTERNAL_DOWNLOADS]: The skill depends on standard external components, including the
xattrandPillowPython libraries, as well as system binaries likeffmpegandffprobe. These are well-known tools required for the skill's media handling and metadata preservation features.
Audit Metadata