web-media-getter
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill documentation recommends storing API keys in environment files (.env), which is a secure practice for managing credentials and prevents the risk of hardcoded secrets appearing in source code.\n- [EXTERNAL_DOWNLOADS]: The skill is designed to perform network requests to well-known and reputable services such as NASA, Wikimedia, the Library of Congress, and the Internet Archive. It includes functionality to download these assets locally when requested by the user.\n- [COMMAND_EXECUTION]: The core functionality of the skill is implemented via local Python scripts (e.g., webmedia.py) that are executed to interface with external media providers.\n- [INDIRECT_PROMPT_INJECTION]:\n
- Ingestion points: Metadata such as titles and descriptions are retrieved from external third-party APIs and processed into the agent context.\n
- Boundary markers: No specific delimiters or boundary warnings for processed metadata are identified in the documentation.\n
- Capability inventory: The skill possesses the ability to perform network operations, write to the file system, and execute local scripts.\n
- Sanitization: The documentation does not specify any sanitization or filtering protocols for the ingested metadata.
Audit Metadata