gallery-dl
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the gallery-dl tool using standard package managers.
- Evidence: pip install gallery-dl and brew install gallery-dl in SKILL.md.
- Evidence: Mentions downloading a standalone binary and checksums from the official project releases at codeberg.org.
- [COMMAND_EXECUTION]: The skill uses the gallery-dl command-line interface to perform its primary functions.
- Evidence: Multiple examples of gallery-dl execution with various arguments in SKILL.md.
- Evidence: The configuration section demonstrates the exec post-processor, which allows running external commands like magick on downloaded files.
- [PRIVILEGE_ESCALATION]: The installation instructions for the standalone binary involve modifying file permissions.
- Evidence: Use of chmod +x on the downloaded binary in SKILL.md.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by processing data from arbitrary third-party URLs provided by the user.
- Ingestion points: URLs from websites like Instagram, Reddit, and Twitter (SKILL.md).
- Boundary markers: None present; the tool directly fetches and processes content from these URLs.
- Capability inventory: File system writes, network operations, and arbitrary command execution via the exec post-processor.
- Sanitization: No specific sanitization or filtering of site-provided metadata is mentioned before it is used in filename templates or post-processor commands.
- [DATA_EXFILTRATION]: The skill utilizes features that access sensitive local data for authentication.
- Evidence: The --cookies-from-browser flag in Step 4 extracts session cookies from installed browsers like Firefox and Chrome.
Audit Metadata