ClawHub
Back to skill

Security audit

gif-generation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward GIF conversion helper with minor activation-scope and dependency-install guidance notes.

Install this if you want agent help converting videos to GIFs. Review the output path before running conversions, and treat any ffmpeg installation command as a separate user-approved system package action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger list includes generic terms like "gif," "video," "ffmpeg," and "conversion," which are common in many normal workflows. Overly broad activation terms can cause the skill to run in unintended contexts, increasing the chance that file-processing commands are suggested or executed against the wrong user inputs or at inappropriate times.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
if ! command -v ffmpeg &> /dev/null; then
    echo "Error: ffmpeg is not installed"
    echo "Install with: sudo apt install ffmpeg (Linux) or brew install ffmpeg (macOS)"
    exit 1
fi
ffmpeg -version | head -1
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.