make-gif
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses allowed bash tools, ffmpeg and ffprobe, to analyze video streams and perform complex multi-pass rendering.
- [COMMAND_EXECUTION]: Executes a localized Python snippet to parse video resolution metadata from JSON output provided by ffprobe.
- [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection by interpolating external variables directly into shell commands. -- Ingestion points: Source file paths ($INPUT) and user-defined parameters ($START, $DURATION, $WIDTH, $FPS) in SKILL.md. -- Boundary markers: No markers or "ignore instructions" directives are used around interpolated variables. -- Capability inventory: Extensive command execution capabilities via Bash (ffmpeg, ffprobe) and Python3. -- Sanitization: No sanitization, escaping, or validation logic is defined to protect against shell metacharacters in input variables.
Audit Metadata