Security audit
Security checks for vulnerabilities and agentic risk
The skill is rated benign with medium confidence: scanners found purpose-aligned image processing and no AIG findings, but flagged installer and image-privacy concerns, and inspection of a referenced script was incomplete.
Before installing, consider whether you are comfortable with the installer resolving an unpinned package version and with images or prompts potentially being sent to external services. The scan was partial: one referenced script was not fully inspected, so the benign verdict is not a guarantee of safety.
Referenced artifact was not completely inspected
scripts/gif2web.sh needs ffmpeg and ffprobe, plus gif2webp or ImageMagick 7 for the WebP.
Referenced artifact was not completely inspected
6. **Convert for the web**: `scripts/gif2web.sh in.gif` (section 6).
Referenced artifact was not completely inspected
## 6. Post-processing: scripts/gif2web.sh
Referenced artifact was not completely inspected
A GIF is the biggest way to ship an animation. `scripts/gif2web.sh` writes an animated WebP (keeps
Referenced artifact was not completely inspected
bash scripts/gif2web.sh pip_wave.gif # -> pip_wave.webp + pip_wave.mp4 next to it
Referenced artifact was not completely inspected
bash scripts/gif2web.sh lol.gif out/ --loops 1 --bg 0x1E1E1E --quality 70
Referenced artifact was not completely inspected
default 200 ms frame time, and `gif2web.sh` on the boat, mascot and sticker GIFs (both the gif2webp and
The installation example invokes an unpinned npm CLI through npx, which can download and execute a changing package version with the user's permissions. Although this is a skill installer rather than an MCP server, the supply-chain exposure is real: a compromised future release could execute malicious code during installation.
The usage examples direct the agent to animate a local image, while the description identifies varg and GPT Image 2.6 as the processing services. Although the README lists the API dependency, it never explicitly discloses that image contents and prompts leave the user's environment, which matters for confidential photos, logos, or other private material.
The agent workflow directs uploading a selected user image to external storage without first checking whether external processing is authorized for that image. Still-image approval concerns appearance rather than disclosure, so following this workflow for a confidential local asset could transmit it outside the user's intended trust boundary; the openly stated cloud-service context reduces, but does not eliminate, this risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
})
Over REST the same `input` goes to `POST https://api.varg.ai/v2/image` (see [gpt-image-2-6](../gpt-image-2-6/)
section 6). Text only (no `files`) works the same way on the text-to-image route.
## 3. Prompt: the motion and the loop lock