jellyfin
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches media metadata from the OMDb API (omdbapi.com) using a user-provided API key to ensure accurate naming and retrieval of IMDB identifiers.
- [COMMAND_EXECUTION]: The script performs directory traversals and file management operations, including creating folders (e.g., 'extrafanart') and renaming files/directories to match Jellyfin standards.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted filenames from the local file system which serve as the primary data source for OMDb API queries and renaming logic.
- Ingestion points: Reads directory and file names using
os.listdirandPath.iterdirinscripts/jellyfin_tool.py. - Boundary markers: None identified.
- Capability inventory: File renaming (
Path.rename), directory creation (Path.mkdir), and network GET requests (httpx.get). - Sanitization: The tool employs regex-based parsing to extract titles and years, providing basic structural validation of the inputs before they are used in path construction or network parameters.
Audit Metadata