pexels-media
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads high-quality media content and metadata from Pexels, a well-known and established stock media service. This functionality is the primary purpose of the skill and uses official API endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data received from the Pexels API, which represents a potential ingestion surface for untrusted content.
- Ingestion points: The skill ingests data via Bash scripts in
SKILL.mdthat usecurlto retrieve JSON responses from the Pexels API. - Boundary markers: No specific boundary markers or instructions to ignore embedded content are used when processing the API data.
- Capability inventory: The skill utilizes
Bash(includingcurlandjq),Write(to create sidecar metadata files), andWebFetchto interact with the external service. - Sanitization: The skill employs
jqto strictly parse and extract specific fields from the JSON API responses before saving them to disk, which is a standard and secure practice for handling structured data.
Audit Metadata