giphy
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npx @useclawlink/clito execute various actions in Giphy, including searching, browsing trending content, and uploading media. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto fetch and run the@useclawlink/clipackage directly from the NPM registry. - [INDIRECT_PROMPT_INJECTION]: The skill ingest data such as GIF titles, tags, and category names from Giphy, which are external sources of untrusted content.
- Ingestion points: Data retrieved via actions like
giphy_search_gifs,giphy_trending_gifs, andgiphy_categoriesfrom the Giphy API. - Boundary markers: No specific delimiters or boundary instructions are provided to the agent for handling external data.
- Capability inventory: The skill can execute CLI commands via the shell and write data back to Giphy (uploads).
- Sanitization: There is no mention of sanitizing or escaping the data retrieved from the Giphy API before it is processed by the agent.
Audit Metadata