spool-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spool-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You have access to the spool CLI for reading and writing photo metadata (EXIF, XMP, IPTC).
Try spool first (if in PATH). If not found, try in order:
~/.local/bin/spool/Applications/Spool.app/Contents/MacOS/spool/usr/bin/spool (deb) or alongside the AppImagecargo run -p spool-cli --spool list <directory> [--recursive]
spool get <file> [field] [--json]
spool set <file>... --field <field> --value <value>
spool set <file>... --json '{"Field":"value",...}'
spool preview <file> [--rotate <90|180|270>]Multiple files can be specified for set — the same fields are written to all files:
spool set IMG_001.jpg IMG_002.jpg IMG_003.jpg --json '{"CameraMake":"Nikon","CameraModel":"FM2"}'
spool set IMG_001.jpg IMG_002.jpg --field DateTaken --value "2024-12-25"spool list returns one file path per line, sorted by filename.
Should activate:
Should NOT activate:
Not every request needs the full SOP. Decide which mode to use:
Query mode — user just wants to see info, no changes:
spool get <file> [--json] and report the results. Done.Annotation mode — user wants to write/change metadata:
If unsure, start with a quick spool get to show current state, then ask if they want to make changes.
Before writing ANY field, check what's already there with spool get <file> --json.
Never silently overwrite existing metadata. The user may have annotated these photos before.
When dealing with many photos, don't try to visually inspect every single one — that will exhaust the context window.
Up to ~20 photos: Read each one individually, full visual inspection.
20–100 photos: Sample strategy:
spool list to get the full file listspool get --json on a few files to check existing metadata100+ photos: Ask the user how to proceed:
Use these clues to infer metadata more accurately:
Roll structure:
Negative1-04-01), frames on the same strip are consecutive shotsDate imprint patterns by era/brand:
'98 10 12, '24 12 25OCT.12.1998, 12/25/202425.12.2024Film stock identification:
KODAK 5063, FUJI SUPERIA, ILFORD HP5What you can infer from visual clues:
For ANY metadata annotation task, follow these steps:
Load references/fields.md to know the available fields and their formats.
Gather metadata from all available sources:
spool preview <file> to generate a correctly oriented temp copy, then read that instead. The preview auto-corrects EXIF orientation. Use --rotate 90/180/270 for manual rotation if needed. Preview is view-only — it never modifies the original file.spool get <file> --json to see what's already there. Flag any fields that already have values.DO NOT proceed to Step 2 until you have inspected all relevant photos and collected all available information.
Assign each piece of information to one of three categories:
| Confidence | Meaning | Example |
|---|---|---|
| confirmed | User explicitly stated, or clearly readable | User said "Nikon FM2"; date imprint reads "2024.12.25" clearly |
| likely | Strong evidence but not 100% certain | Date imprint partially faded but reads "2024.12.2_" with 5 most probable; GPS for "Taipei 101" resolves to well-known coordinates; inferred from same roll as a confirmed photo |
| uncertain | Guessing, ambiguous, or conflicting info | Can't tell if last digit is 6 or 8; user said "somewhere in Taipei" without a specific spot |
Present ALL gathered information in a single summary table, grouped by confidence:
## Annotation Plan
### Confirmed (will write)
File | Field | Value | Source
IMG_001-003 | CameraMake | Nikon | user stated
IMG_001-003 | CameraModel | FM2 | user stated
IMG_001-003 | ISO | 400 | user stated
IMG_001.jpg | DateTaken | 2024-12-25 | date imprint (clear)
IMG_002.jpg | DateTaken | 2024-12-26 | date imprint (clear)
### Likely (need confirmation)
File | Field | Value | Reason
IMG_003.jpg | DateTaken | 2024-12-25 | imprint faded, best guess from "2024.12.2_"
IMG_001-003 | GPSLatitude | 25.0340 | "Taipei 101" — well-known landmark
IMG_001-003 | GPSLongitude| 121.5645 | "Taipei 101" — well-known landmark
### Uncertain (skipping unless you decide)
File | Field | Value | Issue
IMG_004.jpg | DateTaken | ? | no date imprint found
IMG_005.jpg | DateTaken | 2024-12-26 or 28 | last digit unclear
### Existing values (will NOT overwrite unless you say so)
File | Field | Current Value | New Value
IMG_006.jpg | Author | "John" | "Arthur" (user stated)DO NOT proceed to Step 4 until the full annotation plan is presented to the user.
DO NOT proceed to Step 5 until the user has explicitly approved the writes. Wait for confirmation.
ONLY AFTER user confirmation:
spool set with --json for efficiency# Batch: same metadata for multiple files
spool set IMG_001.jpg IMG_002.jpg IMG_003.jpg --json '{"CameraMake":"Nikon","CameraModel":"FM2","ISO":"400"}'
# Per-file: different dates
spool set IMG_001.jpg --field DateTaken --value "2024-12-25"
spool set IMG_002.jpg --field DateTaken --value "2024-12-26"Run spool get <file> --json on a sample file to verify the write succeeded. Report back:
Done: 3 files updated: CameraMake, CameraModel, ISO
Done: 2 files updated: DateTaken
Skipped: 1 file skipped: IMG_004.jpg (no date — user to decide later)DO NOT proceed to Step 7 unless verification succeeded for all written files.
Only offer this step if the user has more than 5 files in the batch.
After annotation is complete, offer the user organization options:
Option A: Move files into folders by a metadata field
Ask: "Want me to organize these files into folders? I can sort by:"
2024-12-25/, 2024-12-26/, ...Nikon FM2/, Canon AE-1/, ...Taipei/, Tokyo/, ...Portra 400/, HP5/, ... (if spool:FilmStock is set)Example result:
photos/
├── 2024-12-25/
│ ├── IMG_001.jpg
│ └── IMG_003.jpg
├── 2024-12-26/
│ └── IMG_002.jpg
└── unsorted/
└── IMG_004.jpg ← no date, couldn't classifyFiles that lack the sorting field go to an unsorted/ folder.
Option B: Decide what still needs annotation
For files that were skipped or had uncertain fields, present a summary:
## Still needs attention
Needs date:
- IMG_004.jpg (no date imprint found)
- IMG_005.jpg (unclear: 2024-12-26 or 28)
Needs GPS:
- IMG_006.jpg (no location provided)
Fully annotated:
- IMG_001.jpg, IMG_002.jpg, IMG_003.jpgAsk: "Want to work through the incomplete ones now, or save them for later?"
Implementation notes:
mkdir -p and mv via Bash to move filesspool get to verify metadata survived the move (it should — metadata is embedded in the file)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.