skills/jeremylongshore/claude-code-plugins-plus-skills/processing-computer-vision-tasks/Gen Agent Trust Hub
processing-computer-vision-tasks
Warn
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requests unrestricted shell access via the Bash(cmd:*) permission in SKILL.md, which allows for the execution of any system command.\n- [REMOTE_CODE_EXECUTION]: The skill's workflow in SKILL.md describes a process where the agent dynamically generates and executes Python code to interact with a plugin, which constitutes dynamic code execution.\n- [EXTERNAL_DOWNLOADS]: The scripts/model_downloader.py script and documentation indicate an intent to download pre-trained models from unspecified online sources without validation or trust-scope constraints.\n- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by processing external image data while having access to high-privilege tools.\n
- Ingestion points: The skill traverses directories in scripts/image_analyzer.py and processes user-provided images via the /process-vision command.\n
- Boundary markers: None identified in instructions or scripts.\n
- Capability inventory: The skill utilizes Bash(cmd:*), Write, Edit, and Read tools.\n
- Sanitization: No sanitization or validation of image metadata or analysis output is implemented.
Audit Metadata