ClawHub
Back to skill

Security audit

GifGrep (tc)

Security checks across malware telemetry and agentic risk

Overview

GifGrep is a straightforward GIF search and download skill with expected third-party provider and local file output behavior.

Before installing, verify the external gifgrep CLI source and prefer pinned versions when possible. Avoid sensitive project names or secrets in GIF search terms, use only Tenor/Giphy API keys intended for this tool, and save downloaded or generated files to a safe workspace directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill explicitly supports downloading remote GIF content to a user-specified local path, but it does not document write-safety constraints such as limiting writes to approved directories, checking for existing files, or warning about overwrites. In an agent setting, that omission can enable unintended filesystem modification or clobbering of user files if the tool is invoked with unsafe paths.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The skill sends user search queries to third-party providers (Tenor/Giphy) and relies on provider APIs, but it does not clearly warn that prompts or search terms may leave the local environment. In privacy-sensitive workflows, users may unknowingly disclose confidential terms, project names, or other sensitive data to external services.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.