Gif Maker

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:27 AM UTC
• Version: 1.0.0

Overview

This GIF-making skill does what it claims, with ordinary local image-processing risks and dependency-installation caveats users should review.

Before installing, be aware that first use may download Python packages into a local virtual environment and that the Pillow dependency is not pinned. Review package installation in your environment, install gifsicle manually only from trusted OS package sources, and run the skill on image files you trust or in a contained workspace.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/run.sh:20
• Finding: Automatic Installation of Unpinned and Unverified Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.sh:20-24`; `requirements.txt:1` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies and runtime package installation **Risk Level**: Medium ### Vulnerable Code `scripts/run.sh:20-24`: ```bash # Install dependencies source "$VENV_DIR/bin/activate" pip install --upgrade pip if [ -f "$SKILL_DIR/requirements.txt" ]; then pip install -r "$SKILL_DIR/requirements.txt" fi ``` `requirements.txt:1`: ```text Pillow>=9.0.0 ``` ### Technical Analysis On the first invocation, `run.sh` creates a virtual environment and automatically downloads and installs the latest available `pip` and any Pillow release satisfying `>=9.0.0`. Neither exact versions nor cryptographic hashes are specified. This means the code ultimately installed and executed is not fully represented by the audited project. Future, unreviewed package versions can enter the execution path without a source-code change. Python package installation may execute package build hooks or other installation-time code, so a compromised package release, package repository, mirror, DNS/network path, or distribution artifact could result in arbitrary code execution. No evidence indicates that Pillow or pip is currently malicious. The vulnerability is the absence of deterministic dependency pinning and integrity verification combined with automatic installation during normal execution. ### Attack Path 1. A user invokes `scripts/run.sh` on a system where the project’s `.venv` directory does not exist. 2. The script creates the virtual environment and executes `pip install --upgrade pip`. 3. It then processes `requirements.txt`, whose `Pillow>=9.0.0` constraint permits any current or future matching Pillow version. 4. An attacker who has compromised an eligible upstream release, package index, configured mirror, or relevant network delivery path supplies a malicious distribution artifact. 5. Pip downloads and installs that ...[truncated 758 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace open-ended dependency constraints with exact, reviewed versions, for example: ```text Pillow==<reviewed-version> ``` 2. Generate a lock file containing cryptographic hashes for every permitted distribution and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Remove `pip install --upgrade pip` from routine skill execution. Pin and provision a reviewed pip version during a separate setup or build phase. 4. Separate dependency installation from normal GIF generation. Make network access and package installation an explicit, user-approved setup operation. 5. Prefer a trusted internal package mirror or prebuilt, verified environment where appropriate. 6. Regularly review and update pinned versions through a controlled dependency-update process that includes vulnerability scanning and integrity-lock regeneration. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill instructs users to run shell scripts and access local files, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the skill's actual capabilities are broader than what a reviewer or runtime policy can infer, increasing the risk of unintended file access or shell execution.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The manifest description and the entire usage guidance are presented in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. This is a natural-language policy issue because it effectively forces a locale/language choice on users without opt-in.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

如果您希望手动管理环境（注意：压缩功能依赖 `gifsicle` 工具，请确保系统已安装）：
- macOS: `brew install gifsicle`
- Ubuntu: `sudo apt-get install gifsicle`

```bash
python3 -m venv skills/gif-maker/.venv

• Confidence: 78% confidence
• Finding: The documentation recommends using 'sudo apt-get install gifsicle', which normalizes privileged execution for setup. Even though this is a common package-install pattern, encouraging root-level commands in skill instructions increases the blast radius if users blindly follow setup steps or if installation sources are modified or spoofed.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The manifest describes a GIF-making utility for converting frame sequences or sprite sheets into GIFs with configurable FPS/layout/looping. However, the implementation also spawns an external executable via `subprocess.run`, which is a broader system-execution capability not stated in the manifest and not strictly necessary to perform the core conversion.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend([input_path, "-o", temp_output])

        try:
            subprocess.run(
                cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
            )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

Pillow>=9.0.0

• Confidence: 98% confidence
• Finding: The dependency is specified as `Pillow>=9.0.0`, which allows installation of many different future or past versions and makes builds non-reproducible. This increases supply-chain risk because a vulnerable or incompatible Pillow release could be resolved at install time without review, especially since this skill processes image files from users.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Pillow has a history of security advisories, and because the manifest does not pin the package version, there is no way to verify whether the installed release includes fixes for known issues. In the context of a GIF/image conversion skill that parses potentially untrusted image inputs, this is more dangerous because image libraries are a common attack surface for denial of service, memory corruption, and parser-related code execution bugs.

Static analysis

No suspicious patterns detected.