GifHorse
v1.2.0Search video dialogue and create reaction GIFs with timed subtitles. Perfect for creating meme-worthy clips from movies and TV shows.
⭐ 1· 2.3k·1 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the runtime instructions: it requires a gifhorse CLI and ffmpeg to transcribe, search dialogue, preview, and produce GIFs. The iMessage sending feature explains macOS-specific install steps (brew ffmpeg-full). Required binaries listed (gifhorse, ffmpeg) are proportionate to the stated functionality.
Instruction Scope
SKILL.md instructs the agent/user to clone a repo, create a virtualenv, pip install the package, and run gifhorse to transcribe entire video directories, download subtitles from online providers, and optionally use Whisper. Those actions legitimately belong to a dialogue-search/GIF tool, but they involve reading large numbers of local video files, creating a local transcription DB, network access to subtitle providers, and optional messaging delivery — all of which have privacy implications. The instructions are prescriptive (run these shell commands) rather than vague, which reduces ambiguity but increases the need to audit the remote code.
Install Mechanism
Although the registry lists this as an instruction-only skill, SKILL.md includes an install recipe that clones https://github.com/Coyote-git/gifhorse.git and runs pip install -e in a venv. Cloning and pip-installing arbitrary code from GitHub executes unreviewed code on the host. GitHub is a common host (lower risk than an unknown personal server), but this is still a remote-code install that should be audited before running. Also the SKILL.md suggests brew install ffmpeg-full (macOS) which is reasonable but OS-specific.
Credentials
The skill does not request environment variables or external credentials in the manifest. That matches SKILL.md, which does not declare API keys. However, the tool will contact subtitle providers and optionally use 'Whisper AI' (unclear whether local Whisper or an external API) and can send via iMessage after configuring a phone number. You should verify whether any network services require credentials or send data off-host.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. The tool stores a transcription database (example: ~/gifhorse/transcriptions.db) and installation writes code and creates a virtualenv under ~/gifhorse — normal for a CLI app, but this is persistent local storage of processed media metadata and transcripts. No evidence it modifies other skills or global agent settings.
What to consider before installing
Before installing: (1) Review the GitHub repository and setup scripts referenced in SKILL.md — pip install -e runs repository code on your machine. (2) Confirm where 'Whisper' runs (local model vs external API) and what subtitle providers are contacted — the tool will access the network and could upload audio/transcripts. (3) Be aware it will read/process your video folders and store a local transcription DB (privacy concern for sensitive videos). (4) If you decide to try it, run installation in an isolated environment (VM or disposable account), inspect the code for any unexpected network calls or credential exfiltration, and avoid enabling the iMessage/--send functionality until you trust the code. If you cannot review the repo, treat the install as higher-risk and consider alternatives packaged by trusted maintainers.Like a lobster shell, security has layers — review code before you run it.
latestvk976819vz58fd5ssza9w9e0btn811s05
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🐴 Clawdis
Binsgifhorse, ffmpeg