ClawHub
Back to skill

Security audit

Giphy

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Giphy helper that sends GIF search terms to Giphy and posts the resulting GIF URL in Discord.

Install if you are comfortable using a dedicated Giphy API key and sending GIF search keywords to Giphy. Avoid using private, identifying, or secret text as search queries, and disable or avoid proactive GIF use in formal or sensitive Discord channels.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
Use this endpoint shape:

`https://api.giphy.com/v1/gifs/search?api_key=<KEY>&q=<ENCODED_QUERY>&limit=1&rating=g&lang=en`

## Output Rule
Confidence
87% confidence
Finding
The skill transmits user-derived query text to the external Giphy API, which is a real data egress boundary. Even though this is expected for a GIF search skill, user prompts can contain sensitive or private context, and the skill provides no minimization, notice, or consent guardrails before sending that content to a third party.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.