imagemagick

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous examples of shell commands using the ImageMagick magick CLI. It includes patterns for batch processing using shell loops (e.g., for f in *.jpg; do ... done) and complex image stacks using escaped parentheses (\( and \)) which are standard for the tool's operation.
  • [DATA_EXPOSURE]: The documentation in references/imagemagick-cli.md describes the @filename reference feature, which allows ImageMagick to read content from local files. The skill proactively identifies the security implications of this feature in references/security.md, advising users to disable indirect reads when processing untrusted input.
  • [INDIRECT_PROMPT_INJECTION]: As a tool designed to process external image files, it is subject to vulnerabilities associated with untrusted coders and delegates. The skill mitigates this by providing a security guide (references/security.md) that recommends setting resource limits and using a restrictive policy.xml to disable risky formats like PDF/PS/SVG when appropriate.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 09:15 PM
Security Audit — agent-trust-hub — imagemagick