skills/zjy365/skills/media-tools/Gen Agent Trust Hub

media-tools

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the execution of shell commands (ffmpeg, ffprobe, magick, identify) to process images and videos. To mitigate security risks, the instructions mandate resolving absolute paths, avoiding string interpolation or the use of eval, and handling filenames starting with hyphens to prevent them from being misinterpreted as command flags.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted media files and directory batches (Ingestion points: SKILL.md). It mandates resolving inputs to absolute paths and forbids command interpolation (Boundary markers: SKILL.md). The skill utilizes local shell commands for processing and inspection (Capability inventory: ffmpeg, ffprobe, magick, convert). It requires output verification with local probes and prevents parameter hijacking by handling leading hyphens (Sanitization: SKILL.md).\n- [EXTERNAL_DOWNLOADS]: The skill allows the agent to access the network to consult official documentation for platform-specific upload limits. This introduces a network interaction based on user-defined goals, though the instructions explicitly prohibit uploading the media files themselves.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 03:52 AM
Security Audit — agent-trust-hub — media-tools