slack-gif-creator
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOW
Full Analysis
- Indirect Prompt Injection (INFO): The skill is designed to process user-supplied text and emoji characters for rendering into GIF frames. This creates a surface for indirect prompt injection where a user might include instructions in the text. However, because the output is a rasterized image format and the skill possesses no network or system-level decision-making capabilities, the risk is negligible.
- File System Operations (SAFE): The
GIFBuilder.saveandvalidators.validate_giffunctions perform file writing and reading respectively. These operations are restricted to the paths provided by the calling agent and do not target sensitive system directories by default. - Dependency Analysis (SAFE): The dependencies listed in
requirements.txt(Pillow, NumPy, ImageIO) are standard, reputable image processing libraries. The use ofimageio-ffmpegis a routine requirement for GIF/video encoding. - Dynamic Pathing (SAFE): The use of
sys.path.appendfor local module resolution within the skill's directory structure is a common development pattern and does not constitute a security risk in this context.
Audit Metadata