skills/zrong/skills/jellyfin/Gen Agent Trust Hub

jellyfin

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches media metadata from the OMDb API (omdbapi.com) using a user-provided API key to ensure accurate naming and retrieval of IMDB identifiers.
  • [COMMAND_EXECUTION]: The script performs directory traversals and file management operations, including creating folders (e.g., 'extrafanart') and renaming files/directories to match Jellyfin standards.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted filenames from the local file system which serve as the primary data source for OMDb API queries and renaming logic.
  • Ingestion points: Reads directory and file names using os.listdir and Path.iterdir in scripts/jellyfin_tool.py.
  • Boundary markers: None identified.
  • Capability inventory: File renaming (Path.rename), directory creation (Path.mkdir), and network GET requests (httpx.get).
  • Sanitization: The tool employs regex-based parsing to extract titles and years, providing basic structural validation of the inputs before they are used in path construction or network parameters.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 04:24 AM