lov-migrate-camera-media

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Python subprocess module to execute system commands necessary for media migration and diagnostics. This includes invoking diskutil for volume metadata retrieval, ioreg for USB link speed analysis, and sync for buffer flushing. It also calls ffmpeg and ffprobe to verify media samples. These calls use list-based arguments and are restricted to validated paths.
  • [INDIRECT_PROMPT_INJECTION]: By processing files from external camera cards, the skill interacts with potentially untrusted data. This attack surface is mitigated by the safe_rel function, which prevents directory traversal attacks by rejecting relative paths containing .., absolute paths, or control characters. The skill also performs source snapshot comparisons to detect unexpected changes during transfer.
  • [EXTERNAL_DOWNLOADS]: The skill depends on standard external components, including the xattr and Pillow Python libraries, as well as system binaries like ffmpeg and ffprobe. These are well-known tools required for the skill's media handling and metadata preservation features.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 04:28 PM