gif-search
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
curlto interact withtenor.googleapis.com, which is an official service for fetching GIF metadata and binary media files. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Tenor API, which is an external and untrusted source.
- Ingestion points: The agent ingests JSON metadata (titles and URLs) from Tenor API responses.
- Boundary markers: None present; instructions do not explicitly warn the agent to ignore instructions embedded in the API results.
- Capability inventory: The skill utilizes
curl -oto write files to the local file system. - Sanitization: The skill provides specific instructions to the agent to URL-encode query parameters, which helps prevent command injection when building the request URL.
Audit Metadata