gif-search
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of the
gifgrepcommand-line utility via Homebrew from a third-party GitHub repository (steipete/gifgrep). It also fetches media content from well-known services including Giphy and Google's Tenor API. - [COMMAND_EXECUTION]: The skill instructions utilize the
Bashtool to perform network requests withcurl, process JSON data withjq, and convert media files usingffmpeg. These operations are performed as part of the skill's primary function of finding and managing GIF files. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided search queries that are interpolated directly into shell commands. While the provided templates use double quotes to wrap the
QUERYvariable, this represents an attack surface where maliciously crafted user input could attempt to escape the command context if the agent does not properly sanitize the arguments.
Audit Metadata