gif-sticker-maker
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/convert_mp4_to_gif.pyutilizessubprocess.runto execute theffmpegutility for video conversion. The implementation follows security best practices by passing arguments as a list rather than a shell string, effectively mitigating command injection risks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user photos and text captions to populate prompt templates for image and video generation. The risk is minimized by the skill's workflow, which encourages the use of a predefined caption table in
references/captions.mdand limits custom captions to short, 1-3 word phrases. - Ingestion points: User photos via the
--subject-refflag and captions via template interpolation inscripts/minimax_image.py. - Boundary markers: Prompt templates in
assets/wrap dynamic inputs in descriptive context. - Capability inventory: File system access (writing output stickers), network access (MiniMax API), and subprocess execution (ffmpeg).
- Sanitization: Arguments are handled via
argparseand API interactions use standard JSON structures. - [EXTERNAL_DOWNLOADS]: The skill communicates with the official MiniMax API (
api.minimax.io) to perform its core functions. These external requests are legitimate and necessary for the stated creative purpose of the skill.
Audit Metadata