Versioned security assessment

Report ID: SA-F7CFBFB8

7/1/2026, 3:26:24 AM

slack-gif-creator security assessment v2

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: slack-gif-creator
Version: v2
Maintainer: ZhanlinCui
Source: github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/slack-gif-creator
Coverage: 6 Files scanned · 1,078 Lines analyzed
Policy version: Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The static analyzer reported high-risk keywords and many command patterns, but review found these are false positives from animation terminology, Python examples, and markdown code fences. No malicious intent, prompt injection, network access, credential access, or obfuscated execution was found. The remaining risk is low because the utilities read and write local image files as part of GIF creation.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

6 Files scanned · 1,078 Lines analyzed

1 item shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 1 evidence location

Capability review items (1)

Low

SKILL.md:52-57 core/gif_builder.py:160-265

Local File Read and Write Capability

The skill can load user-provided images and save generated GIF files to local paths. This is expected for a GIF creation tool, but users should choose output paths carefully.

The save method writes to a caller-provided path, and the documentation shows loading a local image. This is legitimate but still a real filesystem capability.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (4)

Low

SKILL.md:3 SKILL.md:236 core/easing.py:5 core/frame_composer.py:5 core/gif_builder.py:5

False Positive: Weak Cryptography Keywords

Verdict: FALSE_POSITIVE. The weak cryptography matches occur in prose that describes GIF animation utilities, not cryptographic code. No hashing, encryption, or credential handling was found at these locations.

The cited lines are descriptive text about GIF creation and animation frames. There is no cryptographic API call or security-sensitive data flow.

Low

core/easing.py:157-160

False Positive: C2 Keyword Matches

Verdict: FALSE_POSITIVE. The C2 matches are local math variables named c1, c2, and c3 inside easing formulas. They do not indicate command and control behavior.

The variables are constants used in an easing function calculation. The file contains no networking, persistence, command dispatch, or remote endpoint logic.

Low

SKILL.md:24-254

False Positive: Markdown Examples Flagged as Commands

Verdict: FALSE_POSITIVE. The command findings are mainly fenced Python examples and inline identifiers in documentation. The only shell command shown is a dependency installation instruction.

The flagged content is documentation and sample code, not hidden execution logic. The dependency install line is explicit and user-visible.

Low

core/frame_composer.py:19 SKILL.md:154 SKILL.md:242

False Positive: System Reconnaissance Keywords

Verdict: FALSE_POSITIVE. The matches occur in documentation for creating blank frames and imported helper functions. No host inventory, environment probing, or system command collection was found.

The cited text refers to frame creation and reusable animation helpers. There is no evidence of system information gathering.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable