awesome-webpage-image-download
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches image content from external URLs identified in its input payload using the Python standard library's
urllib.requestmodule. It uses a custom User-Agent and enforces a 20-second timeout to manage network requests. - [COMMAND_EXECUTION]: The skill executes a Python entrypoint script (
image_download.py) to process data and manage file downloads. The script securely handles command-line arguments for output directories and prefixes. - [PROMPT_INJECTION]: The skill processes untrusted search results provided via
stdin(an indirect prompt injection surface). It mitigates associated risks through several defensive measures: - Ingestion points: Untrusted data enters the agent context through the
{{ with.payload }}stdin stream. - Boundary markers: No explicit boundary markers are used within the payload data itself.
- Capability inventory: The script possesses capabilities for network reading (
urllib.request) and filesystem writing (pathlib.Path.write_bytes). - Sanitization: The script sanitizes output filenames using a regular expression (
re.sub(r'[^A-Za-z0-9_-]+', '-', ...)in_clean_slot) to prevent directory traversal and validates image integrity by checking magic bytes (PNG, JPEG, GIF, WEBP) before writing files to the disk.
Audit Metadata