media-processing

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is designed to execute external media processing binaries. Python scripts including batch_resize.py, media_convert.py, and video_optimize.py use subprocess.run to invoke ffmpeg, ffprobe, and magick. Similarly, the shell scripts batch-remove-background.sh and remove-background.sh execute the rmbg command to process images.
  • [EXTERNAL_DOWNLOADS]: The shell scripts batch-remove-background.sh and remove-background.sh include a convenience feature that checks for the rmbg CLI and attempts to install it globally using npm install -g rmbg-cli from the official NPM registry if it is not found on the system.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided multimedia files, which constitutes a vulnerability surface for indirect prompt injection via malicious file metadata or content.
  • Ingestion points: Input media files (images, audio, video) processed by scripts in the scripts/ directory.
  • Boundary markers: None identified in the logic for handling file inputs.
  • Capability inventory: The skill can read from and write to the filesystem, and execute shell commands through the invoked media tools.
  • Sanitization: Python scripts use list-based arguments for subprocess.run to prevent shell command injection, and shell scripts employ variable quoting to handle filenames safely.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 12:32 PM