broll-finder
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use
npx -y reelary, which downloads and executes the 'reelary' package from the public npm registry. This is a vendor-owned resource used for the skill's primary functionality. - [COMMAND_EXECUTION]: The skill uses shell commands via the
npxrunner to perform searches against local media files. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied narration text to extract 'beats' and generate visual descriptions for search queries.
- Ingestion points: User-provided narration text requested in Step 1.
- Boundary markers: None specified for the processed text.
- Capability inventory: Shell command execution (
npx), file path discovery, and inter-skill communication (rough-cut,nle-export). - Sanitization: No explicit sanitization or instruction to ignore embedded commands is provided.
Audit Metadata