The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator script (rt_trace.py) and frame extraction utility (rt_extract.py) invoke local scripts and standard system tools (ffmpeg, ffprobe) via subprocess.run. These calls use list-based arguments without shell activation, effectively preventing command injection vulnerabilities despite flags from automated static analysis.
[EXTERNAL_DOWNLOADS]: The skill communicates with well-known and reputable services, including Google Cloud Vision and Picarta, to perform reverse image searches and geolocation. All network activity is directed toward established API endpoints associated with the tool's primary purpose.
[PROMPT_INJECTION]: The skill processes external visual data via multimodal models, creating a surface for indirect prompt injection.
Ingestion points: Image and video files processed by rt_gemini.py and rt_trace.py.
Boundary markers: Prompts include explicit instructions to return only valid JSON and omit additional text.
Capability inventory: Subprocess execution of local scripts and standard utilities (ffmpeg, ffprobe) in scripts/rt_trace.py and scripts/rt_extract.py.
Sanitization: Results are validated via JSON parsing before being synthesized into the final report.
[SAFE]: The skill follows security best practices by requiring API credentials to be managed via environment variables rather than hardcoded secrets. The architecture is transparent, modular, and consistent with its stated purpose of media identification.

reverse-trace