camsnap
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the camsnap utility using a custom Homebrew tap (steipete/tap/camsnap) provided by the author. This involves installing a binary tool from a vendor-specific repository.- [COMMAND_EXECUTION]: The camsnap watch command features an --action flag that executes shell commands in response to motion events, allowing for automated execution based on external camera data.- [CREDENTIALS_UNSAFE]: The skill documents the storage of camera credentials in a local configuration file (~/.config/camsnap/config.yaml) via the camsnap add command.- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection where untrusted camera metadata could influence shell command execution.
- Ingestion points: RTSP/ONVIF camera streams and motion event metadata.
- Boundary markers: None provided in instructions to delimit or ignore embedded metadata instructions.
- Capability inventory: Shell execution capability via the watch --action parameter.
- Sanitization: No documentation of input filtering or escaping for camera-derived triggers.
Audit Metadata