gif-search
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or persistence mechanisms were detected. The skill performs standard media retrieval tasks using common system tools.
- [EXTERNAL_DOWNLOADS]: Fetches GIF metadata and media files from the Tenor API (tenor.googleapis.com). This is a well-known service, and the operations are documented neutrally as they are essential to the skill's functionality.
- [COMMAND_EXECUTION]: Utilizes 'curl' and 'jq' to search for and download media. The skill examples include proper shell quoting for variables containing remote data (e.g., '"$URL"'), which mitigates risks associated with unexpected API responses.
- [INDIRECT_PROMPT_INJECTION]: Identifies an attack surface where untrusted data from the Tenor API is ingested into the agent context via 'jq'.
- Ingestion points: External API responses from tenor.googleapis.com processed in SKILL.md.
- Boundary markers: None present.
- Capability inventory: Network-read and file-write capabilities via 'curl'.
- Sanitization: Relies on 'jq' for structured parsing and shell quoting for safe variable expansion.
Audit Metadata