Trust Assessment
GIF received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 2 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via FFmpeg, Potential Command Injection via Gifsicle.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via FFmpeg The skill documentation provides an `ffmpeg` command example. If an AI agent or tool implements this skill by directly interpolating untrusted user input into the `ffmpeg` command (e.g., for input/output file paths, video filters, or other parameters), it could lead to arbitrary command execution, file manipulation, or path traversal. `ffmpeg` is a powerful tool capable of extensive system interaction. When constructing `ffmpeg` commands based on user input, ensure all user-provided arguments (especially file paths and complex filter strings) are strictly validated and sanitized. Avoid using `shell=True` in `subprocess.run` if possible, and pass arguments as a list. For file paths, ensure they are within an allowed directory and do not contain path traversal sequences (e.g., '..'). | LLM | SKILL.md:30 | |
| HIGH | Potential Command Injection via Gifsicle The skill documentation provides a `gifsicle` command example. Similar to `ffmpeg`, if an AI agent or tool implements this skill by directly interpolating untrusted user input into the `gifsicle` command (e.g., for input/output file paths), it could lead to arbitrary file manipulation or path traversal. `gifsicle` operates directly on the filesystem. When constructing `gifsicle` commands based on user input, ensure all user-provided arguments (especially file paths) are strictly validated and sanitized. Avoid using `shell=True` in `subprocess.run` if possible, and pass arguments as a list. For file paths, ensure they are within an allowed directory and do not contain path traversal sequences (e.g., '..'). | LLM | SKILL.md:45 |
Scan History
Embed Code
[](https://skillshield.io/report/64e192d25565d7fe)
Powered by SkillShield