pr-screenshots
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill contains a command to download and execute a setup script (
setup.sh) via bash process substitution from the author's GitHub repository (github.com/petem24/skills). The instructions inSKILL.mdmitigate this risk by explicitly directing the agent not to run the script itself and instead prompt the user to perform the installation. - [EXTERNAL_DOWNLOADS]: The
upload.shscript performs network requests toapi.imgbb.comto upload images using a user-provided API key. - [COMMAND_EXECUTION]: The skill executes shell commands including
curlfor API communication and the GitHub CLI (gh) for pull request management. - [INDIRECT_PROMPT_INJECTION]: The skill processes local file names which are then embedded as alt-text in markdown comments. Boundary markers such as heredocs and explicit safety warnings regarding sensitive data in screenshots are present to reduce the risk of accidental or malicious data processing.
Audit Metadata