Security audit

Gif Maker

Security checks for vulnerabilities and agentic risk

Overview

This GIF-making skill does what it claims, with ordinary local image-processing risks and dependency-installation caveats users should review.

Before installing, be aware that first use may download Python packages into a local virtual environment and that the Pillow dependency is not pinned. Review package installation in your environment, install gifsicle manually only from trusted OS package sources, and run the skill on image files you trust or in a contained workspace.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: scripts/run.sh:20
Finding: Automatic Installation of Unpinned and Unverified Dependencies
Content: View full analysis
=9.0.0 ``` ### Technical Analysis On the first invocation, `run.sh` creates a virtual environment and automatically downloads and installs the latest available `pip` and any Pillow release satisfying `>=9.0.0`. Neither exact versions nor cryptographic hashes are specified. This means the code ultimately installed and executed is not fully represented by the audited project. Future, unreviewed package versions can enter the execution path without a source-code change. Python package installation may execute package build hooks or other installation-time code, so a compromised package release, package repository, mirror, DNS/network path, or distribution artifact could result in arbitrary code execution. No evidence indicates that Pillow or pip is currently malicious. The vulnerability is the absence of deterministic dependency pinning and integrity verification combined with automatic installation during normal execution. ### Attack Path 1. A user invokes `scripts/run.sh` on a system where the project’s `.venv` directory does not exist. 2. The script creates the virtual environment and executes `pip install --upgrade pip`. 3. It then processes `requirements.txt`, whose `Pillow>=9.0.0` constraint permits any current or future matching Pillow version. 4. An attacker who has compromised an eligible upstream release, package index, configured mirror, or relevant network delivery path supplies a malicious distribution artifact. 5. Pip downloads and installs that ...[truncated 758 chars]
Remediation: View remediation
``` 2. Generate a lock file containing cryptographic hashes for every permitted distribution and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Remove `pip install --upgrade pip` from routine skill execution. Pin and provision a reviewed pip version during a separate setup or build phase. 4. Separate dependency installation from normal GIF generation. Make network access and package installation an explicit, user-approved setup operation. 5. Prefer a trusted internal package mirror or prebuilt, verified environment where appropriate. 6. Regularly review and update pinned versions through a controlled dependency-update process that includes vulnerability scanning and integrity-lock regeneration. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill instructs users to run shell scripts and access local files, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the skill's actual capabilities are broader than what a reviewer or runtime policy can infer, increasing the risk of unintended file access or shell execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description and the entire usage guidance are presented in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. This is a natural-language policy issue because it effectively forces a locale/language choice on users without opt-in.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 78% confidence
Finding: The documentation recommends using 'sudo apt-get install gifsicle', which normalizes privileged execution for setup. Even though this is a common package-install pattern, encouraging root-level commands in skill instructions increases the blast radius if users blindly follow setup steps or if installation sources are modified or spoofed.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
如果您希望手动管理环境（注意：压缩功能依赖 gifsicle 工具，请确保系统已安装）：

macOS: brew install gifsicle

Ubuntu: sudo apt-get install gifsicle

bash
python3 -m venv skills/gif-maker/.venv

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest describes a GIF-making utility for converting frame sequences or sprite sheets into GIFs with configurable FPS/layout/looping. However, the implementation also spawns an external executable via subprocess.run, which is a broader system-execution capability not stated in the manifest and not strictly necessary to perform the core conversion.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/make_gif.py (reported line 56)May include surrounding context.
python
cmd.extend([input_path, "-o", temp_output]) try: subprocess.run( cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL )

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency is specified as Pillow>=9.0.0, which allows installation of many different future or past versions and makes builds non-reproducible. This increases supply-chain risk because a vulnerable or incompatible Pillow release could be resolved at install time without review, especially since this skill processes image files from users.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
Pillow>=9.0.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: Pillow has a history of security advisories, and because the manifest does not pin the package version, there is no way to verify whether the installed release includes fixes for known issues. In the context of a GIF/image conversion skill that parses potentially untrusted image inputs, this is more dangerous because image libraries are a common attack surface for denial of service, memory corruption, and parser-related code execution bugs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.