transform-build-polaroid-collage-with-transloadit
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @transloadit/nodeto download and execute the official Transloadit CLI tool. This resource is owned and maintained by the skill's author, transloadit.\n- [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using the downloaded CLI to perform image merging. It accesses local files provided as inputs and writes the result to a specified output path.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of local image files and paths, representing a potential vulnerability surface.\n - Ingestion points: Absolute paths to local images provided as input to the
@transloadit/nodecommand in SKILL.md.\n - Boundary markers: No specific delimiters or safety instructions are provided to distinguish between file paths and potential injected shell characters, although the command structure is clearly defined.\n
- Capability inventory: The skill has the capability to read local files and perform network operations to upload contents to the Transloadit API for processing.\n
- Sanitization: There are no explicit sanitization steps mentioned in the skill for validating external file paths or contents.
Audit Metadata