Mp4 To Gif

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

This is a straightforward MP4-to-GIF helper with some local hardening issues, but no hidden, deceptive, persistent, or data-stealing behavior.

Reasonable to install for local MP4-to-GIF conversion. Use it on trusted local inputs and normal numeric width/FPS values, avoid running conversions in shared hostile temp-directory environments, and prefer hardening the scripts by validating numeric parameters and using private temporary directories.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: mp4_to_gif.sh:20

Finding

FFmpeg Filter-Graph Injection Through Unvalidated Width and FPS Parameters

Content

View full analysis

/dev/null echo "Converting to GIF..." ffmpeg -y -i "$INPUT" -i "$PALETTE" -lavfi "fps=$FPS,scale=${WIDTH}:-1:flags=lanczos [x]; [x][1:v] paletteuse=dither=bayer:bayer_scale=5:diff_mode=rectangle" "$OUTPUT" 2>/dev/null ``` ### Technical Analysis The `-w` and `-f` arguments are accepted as unrestricted strings and interpolated directly into FFmpeg `-vf` and `-lavfi` filter-graph expressions. Shell quoting prevents these values from being split into separate shell arguments and prevents ordinary shell metacharacters from directly creating a new shell command. However, quoting does not prevent FFmpeg from interpreting commas, semicolons, labels, option separators, and other filter-graph syntax contained in the values. An attacker able to control the script arguments could therefore alter the intended graph, append FFmpeg filters, reference additional resources supported by installed filters, or deliberately construct computationally expensive processing. The exact filters available depend on the local FFmpeg build. ### Attack Path 1. An attacker obtains control over, or influences, the values passed to `-w` or `-f`. 2. The script stores the supplied value without validating that it is a decimal number. 3. The value is embedded in the `-vf` and `-lavfi` expressions. 4. FFmpeg parses attacker-provided filter-graph syntax with the privileges of the invoking user. 5. The injected graph can modify generated output, consume ...[truncated 891 chars]

Remediation

View remediation

4096 )); then echo "Invalid width: expected an integer from 1 to 4096." >&2 exit 1 fi if ! [[ "$FPS" =~ ^[0-9]+$ ]] || (( FPS < 1 || FPS > 60 )); then echo "Invalid FPS: expected an integer from 1 to 60." >&2 exit 1 fi ``` Additional hardening should include: - Use application-appropriate upper bounds to prevent resource exhaustion. - Reject signs, decimals, whitespace, commas, semicolons, brackets, backslashes, and all other non-digit characters. - Consider limiting input duration, dimensions, and output size. - Preserve FFmpeg diagnostics or report them through a controlled error path instead of always discarding standard error. - Add regression tests using malformed values containing FFmpeg filter separators. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: mp4_to_gif.ps1:19

Finding

Unreserved Temporary Palette Path in the PowerShell Converter

Content

View full analysis

$null Write-Host "Converting to GIF..." ffmpeg -y -i $InputFile -i $palette -lavfi "fps=$Fps,scale=${Width}:-1:flags=lanczos [x]; [x][1:v] paletteuse=dither=bayer:bayer_scale=5:diff_mode=rectangle" $OutputFile 2>$null Remove-Item $palette -ErrorAction SilentlyContinue ``` ### Technical Analysis `GetTempFileName()` atomically creates and returns a temporary file. The script then appends `.png` to that returned path and uses the derived filename instead of the file that was securely created. Consequently, the actual palette path is not atomically reserved. The original temporary file also remains behind because cleanup targets only the derived `.png` filename. In a shared temporary directory, another local process may be able to observe or predict the relationship between the created file and the derived palette path, then race the script by creating a conflicting file or link at the latter path. The feasibility of link-based exploitation depends on operating-system configuration, temporary-directory permissions, and the attacker’s ability to create symbolic or other filesystem links. ### Attack Path 1. The script creates a temporary file such as `tmp1234.tmp`. 2. It derives the actual palette path as `tmp1234.tmp.png`, which has not been reserved. 3. A concurrent local attacker observes or races creation of the derived path. 4. The attacker places a conflicting file or filesystem link at that path. 5. FFmpeg runs with `-y` and attempts to write the palette to the attacker-influenced path. 6. Depending on platform protections and permissions, this may overwrite anothe ...[truncated 734 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:27

Finding

Fixed Shared Palette Path in Documented Conversion Commands

Content

View full analysis

-vf "fps=15,scale=480:-1:flags=lanczos,palettegen=stats_mode=diff" /tmp/palette.png # Pass 2: Convert using palette ffmpeg -y -i -i /tmp/palette.png -lavfi "fps=15,scale=480:-1:flags=lanczos [x]; [x][1:v] paletteuse=dither=bayer:bayer_scale=5:diff_mode=rectangle" ``` ### Technical Analysis The documented core method uses the fixed path `/tmp/palette.png` for every conversion. Because `/tmp` is commonly shared among local users and processes, this path can collide with another conversion or with a file prepared by a local attacker. The first FFmpeg command uses `-y`, allowing replacement of an existing destination. If the platform permits following an attacker-created symbolic link, the command could overwrite another file writable by the invoking identity. Between the two passes, another process could also replace the palette and influence the resulting GIF. Although this code appears in documentation, it is presented as the core executable method and may be copied directly or invoked by an Agent following the Skill instructions. ### Attack Path 1. A user or Agent follows the documented two-pass commands. 2. Before the first pass, a local attacker creates `/tmp/palette.png` or a link at that path. 3. FFmpeg executes with `-y` and writes to the fixed shared path. 4. Depending on filesystem protections, an attacker may cause an unintended overwrite or disrupt palette generation. 5. Alternatively, the attacker replaces `/tmp/palette.png` between the two passes. 6. The second FFmpeg invocation consumes the substituted palette, corrupting or manipulating the output. Concurrent legitimate conversions can cause the same collision without malicious activity. ### Impact Assessment Potential consequences inc ...[truncated 485 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Core Method

Two-pass palette-based conversion (always use this over single-pass):

text

# Pass 1: Generate optimized palette

Static analysis

No suspicious patterns detected.