fetch-stock-photos
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill functions as a utility for interacting with the Unsplash API via a Managed Control Plane (MCP) tool.
- [COMMAND_EXECUTION]: The skill instructs the agent to save files to local directories (e.g.,
~/Downloads/stock-photos/). This is a legitimate file system operation necessary for the skill's stated purpose of downloading image assets. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloads from Unsplash, which is a well-known and trusted service for stock photography. It also mentions a fallback to the official Unsplash Source URL.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided search queries. While these queries are interpolated into MCP tool arguments, the capability is scoped to photo searching and does not represent an elevation of privilege or a mechanism for code execution.
- [PROMPT_INJECTION]: The skill includes behavioral constraints (e.g., "Always use this skill when asked for materials," "Prohibited to judge ethnicity without user confirmation"). These are quality-of-service instructions and do not attempt to bypass safety filters or extract system prompts.
Audit Metadata