skills/jeremylongshore/claude-code-plugins-plus-skills/processing-computer-vision-tasks/Gen Agent Trust Hub
processing-computer-vision-tasks
Warn
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation in 'scripts/README.md' identifies a 'model_downloader.py' script intended to fetch pre-trained computer vision models from external online sources. As the source code for this script is missing, the legitimacy of the download URLs and the presence of integrity verification mechanisms cannot be confirmed.\n- [COMMAND_EXECUTION]: The skill configuration allows for unrestricted shell command execution via the 'Bash(cmd:*)' tool in the YAML frontmatter. Furthermore, 'scripts/image_analyzer.py' exhibits deceptive behavior: while its documentation and docstrings claim it performs complex computer vision tasks like object detection and classification, the actual implementation is limited to gathering basic file system statistics such as file counts and sizes.\n- [REMOTE_CODE_EXECUTION]: The workflow described in 'SKILL.md' relies on the agent dynamically generating Python code at runtime to interact with a vision plugin and then executing it. This architectural pattern introduces a risk of code injection if data from the environment or processed files is incorporated into the generated scripts without proper validation or sanitization.
Audit Metadata