gif-sticker-maker
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinscripts/convert_mp4_to_gif.pyto invokeffmpegfor media conversion. The implementation follows security best practices by passing arguments as a list rather than a single string, which effectively prevents shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill communicates with MiniMax API endpoints (
api.minimaxi.comorapi.minimax.io) to generate and download sticker assets. These are official service domains required for the skill's primary functionality. - [INDIRECT_PROMPT_INJECTION]: The workflow ingests user-provided captions and interpolates them into image generation prompts. While this presents a standard attack surface for prompt injection (e.g., trying to influence the AI's output style), the risk is low and contained within the generation of creative assets.
- [CREDENTIALS_SAFE]: The skill requires a
MINIMAX_API_KEY, which it correctly instructs the user to provide via an environment variable. This avoids hardcoding secrets and follows standard security practices for API-based tools.
Audit Metadata