giphy-gif
3 findings (1 high, 2 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-06.
The giphy-gif skill presents MODERATE security risks primarily related to credential management and command injection vulnerabilities. The skill's core functionality (searching Giphy for GIFs) is legitimate, but the implementation has several security concerns: (1) HIGH risk of API key exposure through plain-text storage in config files, (2) MEDIUM risk of command injection through unvalidated query parameters in the documented one-liner pattern, (3) MEDIUM risk of data exposure through external API calls that transmit user queries and credentials. The skill lacks important security controls like input validation, error handling, and timeout protections. While functional for its intended purpose, it requires security hardening before production use, particularly around credential management and input sanitization.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Search and send contextual GIFs from Giphy in Discord conversations. Use when the user wants to react with a GIF, express emotions with a GIF, or when you determine a GIF would enhance the conversation (celebrations, reactions, emotions, humor). Triggers on requests like "send a GIF", "show me a GIF", or when context suggests a GIF reaction would be appropriate.
- Package
- 2 files, 6.6 KB
- SKILL.md
- 736 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Giphy GIF Search · Setup · OpenClaw Config (Recommended) · Usage · Search and Send a GIF · Basic search · Practical Example · 1. Define your search query · 2. Get GIF URL using the helper function below · 3. Send to Discord · Simplified Helper Command · Function to search GIF (copy this pattern)
Findings
HIGH Hardcoded API Key Exposure Risk in Documentation Data Exfiltrationllm
The skill instructions contain examples that encourage users to hardcode their Giphy API key directly in configuration files and environment variables. While API key storage itself is necessary, the documentation shows the actual API key in plain text examples ('your-api-key-here') and demonstrates storing it in ~/.openclaw/openclaw.json without encryption. This creates risk of credential exposure through file system access, backup leaks, or accidental commits to version control.
SKILL.md
Add to `~/.openclaw/openclaw.json`:
```json
{
"skills": {
"entries": {
"giphy-gif": {
"apiKey": "your-api-key-here"
}
}
}
}
```MEDIUM Command Injection Risk via Unvalidated Query Parameter Command Injectionllm
The skill uses bash exec() with user-controlled query strings that are passed through jq for URL encoding, but the query variable is interpolated directly into the bash command string. While jq provides some protection through @uri encoding, the pattern 'QUERY="$query"' in the examples could allow command injection if the query variable contains unescaped quotes or special characters before being passed to the one-liner. The search_gif() helper function is safer but the documented one-liner pattern is vulnerable.
SKILL.md
exec("QUERY='$query'; API_KEY=$(jq -r '.skills.entries.\"giphy-gif\".apiKey // env.GIPHY_API_KEY' ~/.openclaw/openclaw.json 2>/dev/null || echo \"$GIPHY_API_KEY\"); curl -s \"https://api.giphy.com/v1/gifs/search?api_key=${API_KEY}&q=$(printf '%s' \"$QUERY\" | jq -sRr @uri)&limit=1&rating=g\" | jq -r '.data[0].url // empty'")MEDIUM External Network Communication to Third-Party API Data Exfiltrationllm
The skill makes unauthenticated HTTP requests to api.giphy.com, transmitting user search queries and API keys over the network. While Giphy is a legitimate service, this creates data exposure risks: (1) User search queries are sent to external servers, potentially revealing user interests/context, (2) API keys are transmitted in URL parameters which may be logged by intermediary proxies/servers, (3) No validation of response data before processing, (4) Relies on external service availability and trustworthiness.
SKILL.md
curl -s "https://api.giphy.com/v1/gifs/search?api_key=${API_KEY}&q=${encoded_query}&limit=1&rating=g&lang=en"What is in the package
| File | Kind | Size |
|---|---|---|
CHANGELOG.md | doc | 811 B |
SKILL.md | doc | 5.8 KB |
External hosts referenced
api.giphy.com developers.giphy.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
GIPHY_API_KEY API_KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/giphy
- Raw scan result: giphy-scan.json
- Badge for your README:
- Request a re-scan