find-me-a-museum-image
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches artwork metadata and images from official open-access APIs of well-known cultural institutions, including The Metropolitan Museum of Art, Art Institute of Chicago, Cleveland Museum of Art, and the Smithsonian.\n- [COMMAND_EXECUTION]: The skill instructions direct the AI agent to execute a local Python script (
scripts/museum_image.py) to perform museum searches and image downloads. The script uses only the Python standard library and performs limited filesystem operations within agent-specified directories.\n- [CREDENTIALS_UNSAFE]: The documentation describes the use of aSMITHSONIAN_API_KEYenvironment variable for one specific museum collection. No credentials or keys are hardcoded in the skill; users are guided to obtain their own free key from the official provider.\n- [SAFE]: The Python script includes a fallback mechanism that disables SSL certificate verification if the local Python environment lacks root certificates. While this is a security trade-off, its impact is limited to the retrieval of public cultural data from trusted institutional servers.
Audit Metadata