Security audit

Gif Whatsapp

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it sends WhatsApp media using broad command execution and processes downloaded remote GIFs without enough safeguards.

Review this skill before installing if you do not want an agent to send WhatsApp media or run local media-conversion commands. Prefer using it only when you explicitly ask for a GIF, and treat the generated media files as temporary data that should be uniquely named and deleted after sending.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:30
Finding: Unvalidated Remote Media Is Downloaded and Parsed by FFmpeg
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:41
Finding: Predictable Temporary Files Persist After Media Delivery
Content: View full analysis
/dev/null cp /tmp/g.mp4 /root/.openclaw/workspace/g.mp4 ``` This conflicts with the metadata claim that downloaded files are cleaned up after sending: ```yaml notes: "Uses the platform message tool (already configured) for WhatsApp delivery. gifgrep searches Tenor/Giphy only. Downloads are saved to /tmp and cleaned up after sending." ``` ### Technical Analysis The documented workflow contains no step that deletes the original download, converted MP4, or workspace copy after sending. It also repeatedly uses predictable shared paths such as `/tmp/gif.gif`, `/tmp/gif.mp4`, and `/root/.openclaw/workspace/gif.mp4`. Predictable filenames create collision and race risks when multiple executions overlap. One execution can overwrite another execution's media, and a failed or interrupted run can leave stale content that is later copied or sent. Persistent workspace copies also retain user-requested media beyond the operation and make it accessible to later tasks that can read the same workspace. The audit evidence does not establish that an untrusted local user can create links or files under the relevant runtime permissions. Therefore, the confirmed issue is limited to missing cleanup, stale-file reuse, and concurrent execution collisions rather than a confirmed local privilege-escalation primitive. ### Attack Path 1. A Skill invocation downloads and converts media using the fixed temporary filenames. 2. The converted file is ...[truncated 835 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction 'Search in English for best results' imposes a specific language preference in the skill's natural-language guidance. Under the policy, forcing a language without user opt-in is a locale/language policy concern, and the file does not provide an explicit user choice or opt-in mechanism.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.