pexels-footage
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads media files from official Pexels API endpoints (api.pexels.com) using search terms provided to the script.
- [COMMAND_EXECUTION]: A bash wrapper (pexels-footage.sh) is used to invoke the core Python logic (scripts/pexels_search.py).
- [PROMPT_INJECTION]: The skill processes untrusted metadata from Pexels (photographer names, alt text) in scripts/pexels_search.py. Ingestion occurs via API responses, boundary markers are absent, and capabilities include file-writing and network access. Sanitization is limited to filename prefixing.
- [SAFE]: PEXELS_API_KEY is managed via environment variables and sent exclusively to official Pexels endpoints. No persistence, obfuscation, or unauthorized access mechanisms were detected.
Audit Metadata