pexels-stock-photos
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: Fetches image data and metadata from Pexels' official API (api.pexels.com) and CDN (images.pexels.com) domains.
- [SAFE]: Uses environment variables for managing the PEXELS_API_KEY, avoiding hardcoded credentials in the skill or tests.
- [INDIRECT_PROMPT_INJECTION]: Ingests search results and metadata from the Pexels API at runtime which could theoretically contain malicious instructions.
- Ingestion points: API search results described in SKILL.md.
- Boundary markers: None.
- Capability inventory: File downloads to /tmp and network operations via curl in SKILL.md.
- Sanitization: The skill uses structured JSON fields for specific data extraction.
Audit Metadata