ClawHub
Back to skill

Security audit

Gif Picker

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward local reaction GIF picker with a disclosed setup script that downloads sample GIFs into a local library.

Before installing, expect the setup step to make outbound requests to public media hosts and save GIF files in the OpenClaw workspace. Review or replace the sample GIF URLs if media provenance matters, and use the picker only when you actually want the agent to attach a reaction GIF.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a mismatch because the declared description is limited to selecting and sending local reaction GIFs by tag, with no permissions declared, but the included populate.sh script performs additional capabilities beyond that purpose: it fetches media from remote internet sources and writes files into the local library directory. While the Python script aligns with the stated selection behavior, the overall skill codebase includes network download and local library population behavior that is not represented in the description.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The manifest describes a local GIF picker/sender, which implies operating on an existing local collection. This script's documented and actual behavior is to fetch assets from GitHub and Giphy over the network and build that collection, which is a materially broader behavior than merely selecting local GIFs.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
Using curl to retrieve GIFs from raw.githubusercontent.com and media.giphy.com introduces outbound network access unrelated to the manifest's narrow local-selection purpose. A local reaction GIF picker would not obviously require external downloads unless that behavior were explicitly declared as part of scope.

Missing User Warnings

Low
Confidence
83% confidence
Finding
This markdown file describes and triggers `populate.sh`, which downloads sample GIFs into the local library. While the behavior is implied by labels like 'Download sample reaction GIFs,' there is no explicit warning that first-time setup performs network access and writes multiple files to the user's filesystem, which is the type of disclosure SQP-2 expects for potentially privacy- or system-affecting actions in markdown descriptions.

Vague Triggers

Medium
Confidence
91% confidence
Finding
This JSON manifest defines activation-like tags such as "praise," "congratulate," "good-job," and "proud" without any constraints, negative examples, or clear scope. Because these are common conversational terms, a system using tags for matching could invoke the skill in many ordinary exchanges unrelated to explicitly requesting a reaction GIF.

Vague Triggers

Medium
Confidence
88% confidence
Finding
Tags like "agreement," "teamwork," and especially "let-go" and "high-five" are broad enough to match normal conversation rather than deliberate invocation. The manifest provides no indication of required context, exact trigger phrases, or exclusion conditions to prevent accidental matches.

Session Persistence

Medium
Category
Rogue Agent
Content
install:
      - id: setup
        kind: setup
        label: "Create GIF library directory"
        run: "mkdir -p {baseDir}/gifs"
      - id: populate
        kind: populate
Confidence
60% confidence
Finding
Create GIF library directory" run: "mkdir -p {baseDir}/gifs" - id: populate kind: populate label: "Download sample reaction GIFs" run: "bash {baseDir}/populate.sh

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.