media-processing
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute external media processing binaries. Python scripts including
batch_resize.py,media_convert.py, andvideo_optimize.pyusesubprocess.runto invokeffmpeg,ffprobe, andmagick. Similarly, the shell scriptsbatch-remove-background.shandremove-background.shexecute thermbgcommand to process images. - [EXTERNAL_DOWNLOADS]: The shell scripts
batch-remove-background.shandremove-background.shinclude a convenience feature that checks for thermbgCLI and attempts to install it globally usingnpm install -g rmbg-clifrom the official NPM registry if it is not found on the system. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided multimedia files, which constitutes a vulnerability surface for indirect prompt injection via malicious file metadata or content.
- Ingestion points: Input media files (images, audio, video) processed by scripts in the
scripts/directory. - Boundary markers: None identified in the logic for handling file inputs.
- Capability inventory: The skill can read from and write to the filesystem, and execute shell commands through the invoked media tools.
- Sanitization: Python scripts use list-based arguments for
subprocess.runto prevent shell command injection, and shell scripts employ variable quoting to handle filenames safely.
Audit Metadata