video-to-gif
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the Bash tool to execute
ffmpegandffprobecommands locally. These commands are used to inspect video metadata (width, height, duration) and perform two-pass video-to-GIF conversion.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted input video files provided by the user. The filenames are interpolated into shell commands.\n - Ingestion points: Filenames and paths for input video files (e.g.,
<input>) used in theffmpegcommands.\n - Boundary markers: The skill uses double quotes around filename variables (e.g.,
"<input>") in command templates to handle spaces, though this does not fully mitigate all command injection risks if the agent fails to sanitize inputs.\n - Capability inventory: The skill requires
Bashaccess to runffmpegandffprobefor file processing.\n - Sanitization: Basic shell quoting is suggested in the command examples.\n- [SAFE]: The skill includes instructions to install prerequisites using well-known package managers such as Homebrew (
brew install ffmpeg) and APT (sudo apt install ffmpeg). These are standard procedures for setting up required software environments.
Audit Metadata