gif-sticker-maker
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts to perform image generation, video generation, and format conversion. These scripts utilize standard libraries and external tools like
ffmpegvia secure subprocess calls that pass arguments as lists to prevent shell injection.- [EXTERNAL_DOWNLOADS]: The skill downloads generated media assets from MiniMax API endpoints. These are recognized services for generative AI content, and the skill handles the credentials using environment variables as a safe practice.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied photos and captions to generate stickers, creating an attack surface for indirect prompt injection. Maliciously crafted captions could attempt to influence the output of the generation models. - Ingestion points: User photos and captions are collected in Step 0 and Step 1 of the workflow.
- Boundary markers: Not present; user-provided captions are directly interpolated into the prompt templates.
- Capability inventory: The skill possesses network access via the
requestslibrary and file processing capabilities viaffmpeg. - Sanitization: No explicit sanitization or validation of user captions is performed before they are sent to the generation APIs.
Audit Metadata