pexels-media

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches media files and metadata from official Pexels domains including api.pexels.com, images.pexels.com, and videos.pexels.com. These network operations are intrinsic to the skill's primary function of sourcing royalty-free media.
  • [COMMAND_EXECUTION]: The instructions utilize curl for network communication and jq for processing JSON responses. These tools are used appropriately within the documented workflow for searching media and creating metadata files.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Pexels API, which constitutes an ingestion surface for untrusted content.
  • Ingestion points: Media metadata (e.g., photographer names, alt text, titles) returned from api.pexels.com in SKILL.md.
  • Boundary markers: The skill uses structured JSON parsing via jq to extract specific fields, which provides a level of structural delimitation.
  • Capability inventory: The skill possesses network access (curl), structured data processing (jq), and file writing capabilities (storing images and sidecar JSON files).
  • Sanitization: There is no explicit sanitization of the strings retrieved from the API before they are written to the sidecar metadata files, though the use of jq for construction reduces the risk of schema confusion.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 02:44 PM