img-recog
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Uses
subprocess.runto callffmpegandffprobefor image compression and metadata extraction. Both tools are standard utilities, and the inputs (local paths or generated temporary files) are handled safely without shell injection risks. - [EXTERNAL_DOWNLOADS]: Fetches images from user-provided URLs using the
requestslibrary. This is a core feature for image recognition and does not involve executing remote code. - [DATA_EXPOSURE]: Loads API keys and base URLs from
~/.wmyskills/img-recog/provider.yaml. The skill includes explicit instructions for the agent never to read or display this file, and the code follows standard configuration patterns.
Audit Metadata