imagemagick
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous examples of shell commands using the ImageMagick
magickCLI. It includes patterns for batch processing using shell loops (e.g.,for f in *.jpg; do ... done) and complex image stacks using escaped parentheses (\(and\)) which are standard for the tool's operation. - [DATA_EXPOSURE]: The documentation in
references/imagemagick-cli.mddescribes the@filenamereference feature, which allows ImageMagick to read content from local files. The skill proactively identifies the security implications of this feature inreferences/security.md, advising users to disable indirect reads when processing untrusted input. - [INDIRECT_PROMPT_INJECTION]: As a tool designed to process external image files, it is subject to vulnerabilities associated with untrusted coders and delegates. The skill mitigates this by providing a security guide (
references/security.md) that recommends setting resource limits and using a restrictivepolicy.xmlto disable risky formats like PDF/PS/SVG when appropriate.
Audit Metadata