pexels-footage

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads images and video files from Pexels (api.pexels.com). This is the primary intended function of the skill and targets a well-known media provider.
  • [CREDENTIALS_UNSAFE]: The skill requires a PEXELS_API_KEY, which is correctly managed through an environment variable rather than being hardcoded. Instructions follow best practices by directing users to the official Pexels registration page.
  • [COMMAND_EXECUTION]: The skill uses a bash wrapper (pexels-footage.sh) to execute a Python script. The arguments are passed safely through exec and argparse in Python, minimizing command injection risks.
  • [DATA_EXFILTRATION]: No evidence of unauthorized data access or exfiltration. Network operations are limited to the Pexels API and file downloads to the user-specified output directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 12:49 PM
Security Audit — agent-trust-hub — pexels-footage