Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Save Image
v1.0.0Download images, GIFs, and media from any URL using proper headers, Referer spoofing, and scraping to handle CDNs and social media sources correctly.
⭐ 0· 55·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name and description match the included instructions and script: the skill is focused on fetching images with browser headers, referer spoofing, and a two-step scrape. However, SKILL.md instructs use of external tools (gifgrep, yt-dlp, jq) and provider-specific API keys (GIPHY_API_KEY) that are not declared in the skill metadata. A legitimate image-download helper should declare required binaries and any credentials it may need.
Instruction Scope
Runtime instructions and the script stay within the stated scope: performing HTTP fetches, scraping pages for CDN URLs, and validating file types. The instructions do not ask to read unrelated local files or to exfiltrate data to unexpected endpoints. They do instruct the agent to run external tools (yt-dlp, gifgrep) which have broader scraping/downloading capabilities; those tools can change the effective scope when present.
Install Mechanism
There is no install spec (instruction-only), which is low-risk from an automatic-install perspective. But because SKILL.md depends on third-party binaries (gifgrep, yt-dlp, jq, grep, curl, file), the skill should have declared them or provided guidance to install them — absence of that is a transparency/operational gap.
Credentials
The skill metadata declares no required environment variables, but references in references/tools.md note that GIPHY_API_KEY is required for some gifgrep providers. That mismatch is concerning: the skill may later ask for or expect API keys or tokens that were not disclosed up front. No other credentials are requested, which is appropriate for this functionality, but the GIPHY_API_KEY mention should have been declared.
Persistence & Privilege
The skill does not request permanent presence (always:false) and does not modify other skills or system settings. Autonomous invocation is allowed (platform default) but is not combined here with broad credentials or always:true, so privilege footprint is limited.
What to consider before installing
This skill appears to do what it says (download images with proper headers and simple scraping), but there are some gaps you should consider before installing:
- Missing dependency declarations: SKILL.md expects external tools (gifgrep, yt-dlp, jq, grep, curl, file). Confirm those binaries are present on the host or ask the author to declare them and provide an install script. gifgrep and yt-dlp in particular can perform broad downloads and may have their own credential requirements.
- Undeclared API key: references/tools.md mentions GIPHY_API_KEY for Giphy usage but the skill metadata doesn't list any required env vars. If you plan to use Giphy via gifgrep, obtain and provide that API key only when necessary and verify how the skill stores/uses it.
- No hidden network endpoints were found in the included files, and the provided shell script only performs HTTP GETs and local file checks. Still, be mindful that scraping can retrieve login-gated or copyrighted content — avoid using private credentials or downloading material you do not have rights to.
- Operational limits: the instructions note Cloudflare and login-gated content won't work; browser automation or authenticated sessions are required for those cases.
Recommendations: ask the skill author to (1) list required binaries and env vars in the metadata, (2) provide installation instructions or package references for gifgrep/yt-dlp if the skill relies on them, and (3) confirm how any API keys are used and whether they are stored. Test the script on innocuous public images first.Like a lobster shell, security has layers — review code before you run it.
latestvk97ch3b04xzxhcaext45t0rgb984nx41
License
MIT-0
Free to use, modify, and redistribute. No attribution required.