Skills
skills/useosint/osint-skills/is-this-photo-real/Gen Agent Trust Hub

is-this-photo-real

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use various CLI tools for forensic analysis, including ffprobe, mediainfo, exiftool, yt-dlp, and sha256sum (found in SKILL.md, reference/tool-catalogue.md, and reference/verification-checklist.md). These tools are used to inspect file headers, metadata, and container structures.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes yt-dlp to download high-quality renditions of video content from external platforms for verification purposes.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted external media and its associated metadata (e.g., EXIF, IPTC, and C2PA manifests).
  • Ingestion points: External media files downloaded via yt-dlp and metadata fields parsed by exiftool (mentioned in SKILL.md and reference/verification-checklist.md).
  • Boundary markers: No specific delimiters or instructions to ignore embedded content within the metadata are provided.
  • Capability inventory: The skill has the capability to execute several shell commands (ffprobe, exiftool, yt-dlp, sha256sum, mediainfo) to process the ingested data.
  • Sanitization: No sanitization or validation steps are defined for the content extracted from external media or metadata tags.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 04:29 PM
Security Audit — agent-trust-hub — is-this-photo-real