The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installation instructions require fetching code or binaries from github.com/steipete/gifgrep (via go install) or steipete/tap/gifgrep (via brew). These sources are personal repositories and are not affiliated with the skill author or established trusted organizations.
[COMMAND_EXECUTION]: The skill executes the gifgrep binary to perform GIF searches, TUI browsing, and file extraction. This involves making network requests to Tenor/Giphy APIs and performing local file system operations, such as downloading content to ~/Downloads and using the open command (via --reveal) on the host system.
[PROMPT_INJECTION]: The skill processes titles, tags, and URLs from external GIF providers, which introduces a surface for indirect prompt injection.
Ingestion points: External metadata from Tenor and Giphy APIs (e.g., GIF titles and tags) is ingested into the agent context when listing search results.
Boundary markers: No explicit delimiters or boundary markers are used to isolate untrusted external metadata from the agent's instructions.
Capability inventory: The skill possesses the capability to execute shell commands and write to the local file system.
Sanitization: There is no evidence of sanitization or validation performed on the metadata fetched from the external APIs before it is presented to the agent.

gifgrep