ClawHub
Back to skill

Security audit

openclaw-whatsapp-gif

Security checks across malware telemetry and agentic risk

Overview

This skill’s network access and media handling fit its GIF-sending purpose, with some optional features users should leave disabled unless needed.

Install only if you want an agent to search external GIF services and send media through WhatsApp. Keep web-scraping fallback and telemetry disabled unless you explicitly need them, and avoid sending sensitive personal text as GIF search queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill invokes shell scripts, accesses environment variables for API keys, performs network fetches, and writes temp cache files, yet no explicit permissions are declared. This creates a governance gap: a host may grant broader capabilities than reviewers expect, and users cannot easily assess that the skill can reach external services and write local data.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The stated purpose is narrowly framed as sourcing and sending safe reaction GIFs, but the documented behavior also includes remote media download and caching, support for non-GIF formats, optional web-scraping fallback, and optional telemetry logging. This mismatch can mislead reviewers and users about data flows and attack surface, especially since scraping and telemetry introduce additional privacy, compliance, and content-sourcing risks.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The optional `search_tenor_web` path broadens content acquisition from vetted API responses to ad hoc HTML scraping and regex extraction of media URLs. That weakens the stated safety model because scraped results bypass provider-side metadata, safety fields, and the script's text-based filtering, making policy enforcement and deterministic behavior less reliable.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
When telemetry is enabled, the script appends the raw user query, selected media URL, and error details to a log file in a temporary directory without any user-facing notice or data minimization. In a messaging context, queries can contain sensitive personal content, and temp-directory logs may be readable by other local users, retained longer than expected, or collected by host-level monitoring.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.