trakt
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses the official Trakt.tv API for media discovery, communicating over HTTPS to a well-known service domain.\n- [SAFE]: API credentials are managed securely via the TRAKT_CLIENT_ID environment variable, avoiding hardcoded secrets.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external media metadata such as titles and taglines from the Trakt API, which represents a standard indirect injection surface common to data-fetching tools.\n
- Ingestion points: scripts/trakt-cli fetches movie and TV data from api.trakt.tv.\n
- Boundary markers: Absent; output is printed directly to the terminal.\n
- Capability inventory: The tool is limited to network requests and standard output, with no file system write or code execution capabilities.\n
- Sanitization: Absent; metadata strings are not filtered before display.
Audit Metadata