Gif Whatsapp

PassAudited by ClawScan on May 10, 2026.

Overview

This is a straightforward WhatsApp GIF-sending skill, but it uses shell commands and the configured WhatsApp message tool to download, convert, and send media.

Install this only if you are comfortable with the agent downloading GIFs, converting them locally, and sending them through your configured WhatsApp message tool. Check the recipient/context before sending, and manually clean up generated workspace GIF files if you do not want them retained.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can send GIF media to WhatsApp recipients when using this skill.

Why it was flagged

The skill can run local commands and send media through the WhatsApp message tool. This is expected for the stated purpose, but it is user-impacting outbound messaging.

Skill content
allowed-tools: [exec, message] ... message action=send to=NUMBER message=" " filePath=/root/.openclaw/workspace/gif.mp4 gifPlayback=true
Recommendation

Use the skill only when you want the agent to send a GIF, and verify the recipient and context before allowing WhatsApp sends.

What this means

Messages sent by the skill may appear as coming from the user's WhatsApp account or configured messaging identity.

Why it was flagged

The skill relies on the platform's already-configured WhatsApp messaging authority rather than its own credentials. That is purpose-aligned but still uses the user's messaging identity.

Skill content
Uses the platform's built-in `message` tool — no separate WhatsApp credentials needed
Recommendation

Confirm that the platform message tool is connected to the intended WhatsApp account and that the agent should be allowed to send media from it.

What this means

The skill processes externally sourced GIF files locally before sending them.

Why it was flagged

The workflow downloads a GIF and processes it with ffmpeg using shell commands. This is central to the skill's conversion purpose and is not hidden.

Skill content
curl -sL "GIF_URL" -o /tmp/gif.gif ... ffmpeg -i /tmp/gif.gif ... /tmp/gif.mp4 -y
Recommendation

Keep ffmpeg and related tools updated, and prefer GIF URLs returned by the intended Tenor/Giphy search flow.

What this means

A sent GIF file may remain locally in the workspace until overwritten or deleted.

Why it was flagged

The metadata says downloads are cleaned up, but the documented workflow copies the MP4 into the workspace and does not show a cleanup step.

Skill content
Downloads are saved to /tmp and cleaned up after sending ... cp /tmp/gif.mp4 /root/.openclaw/workspace/gif.mp4
Recommendation

Delete generated workspace GIF files after sending if local retention matters, or update the skill instructions to include explicit cleanup.