ClawHub
Back to skill

Security audit

GifGrep (tc)

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent GIF search and processing helper, with ordinary network, API key, install, and file-output behavior for that purpose.

Before installing, review the gifgrep upstream package source and consider pinning a specific trusted version instead of using @latest. Use non-sensitive output paths because downloads and generated images may create or replace files at the paths you provide, and provide Giphy/Tenor API keys only if you are comfortable using them with those services.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding
Unpinned Third-Party Executable Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12–23 **Vulnerability Type**: Unpinned third-party executable dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml "install": [ { "type": "homebrew", "package": "steipete/tap/gifgrep", "label": "Install GifGrep CLI (Homebrew)" }, { "type": "go", "package": "github.com/steipete/gifgrep/cmd/gifgrep@latest", "label": "Install GifGrep CLI (Go)" } ] ``` ### Technical Analysis The skill directs users or an agent runtime to install executable software from external third-party sources without pinning it to an immutable, audited release. In particular, the Go installation uses the mutable `@latest` selector. The Homebrew dependency also lacks a fixed version, commit, checksum, or signature requirement. Consequently, the code installed in the future may differ from the code reviewed when this skill was published. If the upstream repository, release process, Go module, or Homebrew tap is compromised, an attacker can replace the resolved artifact with malicious code. This finding concerns supply-chain integrity. The audited skill does not itself contain a malicious payload, and the available evidence does not establish that the referenced upstream project is currently malicious. ### Attack Path 1. An attacker compromises the upstream source repository, release credentials, Go module publication path, or Homebrew tap. 2. The attacker publishes a malicious version as the newest release or modifies the unpinned Homebrew formula. 3. A user or agent installs the dependency using one of the declarations in `SKILL.md`. 4. The package manager resolves the mutable dependency to the attacker-controlled version. 5. Malicious installation logic or the resulting `gifgrep` executable runs under the privileges of the installing or invoking user. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the pr ...[truncated 510 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a specific audited semantic version, such as `@vX.Y.Z`, or preferably an immutable commit or module version whose contents have been reviewed. 2. Pin the Homebrew installation to a controlled, versioned formula rather than relying on the current state of an unpinned tap. 3. Publish and verify cryptographic checksums or signatures for release artifacts before installation. 4. Use trusted release automation with protected tags, branch protection, mandatory review, and tightly scoped publication credentials. 5. Add an explicit upgrade process in which new dependency versions are reviewed and tested before the pins are changed. 6. Where supported, record dependency provenance and verify signed attestations to reduce the risk of repository or release-pipeline compromise. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
89% confidence
Finding
This markdown file describes that the skill can 'download' and 'process' GIFs, which implies network access and file creation, but it does not include any caution or disclosure about modifying the local workspace. The usage examples later write files to explicit output paths, reinforcing that the skill affects user data/storage without a warning section.

Missing User Warnings

Low
Confidence
93% confidence
Finding
The example explicitly enables download and saves content to '/workspace/downloads/birthday.gif', but the markdown provides no warning that running this operation creates or may overwrite local files. For markdown skills, user-facing documentation should disclose behaviors that affect user data or filesystem state.

Missing User Warnings

Low
Confidence
91% confidence
Finding
These examples save generated images to '/workspace/output/frame.png' and '/workspace/output/sheet.png', but the documentation does not warn users that the operations create or replace files. Because the skill description is markdown, it should explicitly disclose file-writing behavior that may affect user data.

Static analysis

No suspicious patterns detected.