mediaio-generate

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the mediaio CLI tool and standard shell utilities such as curl, grep, mktemp, and file to manage workflows. It includes strict rules for executing these commands, such as quoting identifiers that contain spaces and using host-native approval mechanisms for networked processes.
  • [EXTERNAL_DOWNLOADS]: The skill fetches model metadata and generated media assets from Media.io's production registry (e.g., vapi.media.io) and storage services. It follows safe practices by using the CLI's dedicated download command and verifying downloaded files using MIME type inspection.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from CLI outputs (like model lists and task statuses) and user-supplied prompts. It mitigates potential injection risks through robust verification steps, including mandatory schema lookups (model get), byte-for-byte identifier mapping, and strict result URL handling that avoids manual transcription or editing.
  • [SAFE]: No malicious patterns, obfuscation, or unauthorized data exfiltration attempts were detected. The skill demonstrates a strong security posture by delegating sensitive operations (like authentication and updates) to the vendor's official CLI and respecting platform-level permission boundaries.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 09:09 AM
Security Audit — agent-trust-hub — mediaio-generate