media-processing
Pass
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION] (SAFE): The skill relies on external media tools to perform its primary function. The implementation in scripts/media_convert.py uses subprocess.run() with list-based arguments rather than shell strings. This approach ensures that input filenames and parameters are not interpreted by a shell, eliminating the risk of command injection.
- [EXTERNAL_DOWNLOADS] (SAFE): Installation instructions provided in SKILL.md point to trusted system package managers including Homebrew, apt-get, and winget, as well as official project websites for FFmpeg and ImageMagick.
- [INDIRECT_PROMPT_INJECTION] (SAFE): While the skill ingests external data in the form of file paths, it lacks a vulnerable attack surface for prompt injection. 1. Ingestion points: File paths passed via the inputs argument in scripts/media_convert.py. 2. Boundary markers: Handled through direct argument passing in the CLI wrapper. 3. Capability inventory: Local execution of media binaries; no network or credential access. 4. Sanitization: Use of parameterized argument lists in subprocess calls prevents malicious file paths from executing arbitrary code.
Audit Metadata