skills/tt-a1i/hermes-agent/gif-search/Gen Agent Trust Hub

gif-search

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes curl and jq to interact with the Tenor API and process search results. It also uses curl to download image files to the local directory.
  • [EXTERNAL_DOWNLOADS]: The skill fetches GIF content and metadata from tenor.googleapis.com, which is an official Google service. These network operations are consistent with the skill's primary purpose and target well-known infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents a potential surface for indirect prompt injection as it ingests data from an external API and uses it in shell commands.
  • Ingestion points: API responses from the Tenor search endpoint in SKILL.md.
  • Boundary markers: None; the skill uses raw strings extracted by jq from the JSON payload.
  • Capability inventory: The skill uses curl to write files to the disk based on the API output.
  • Sanitization: The skill relies on jq for data extraction but does not implement validation for the resulting URLs before downloading.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 12:48 PM
Security Audit — agent-trust-hub — gif-search