gifgrep
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- EXTERNAL_DOWNLOADS (MEDIUM): The skill installs software from untrusted external sources. Specifically, it uses a third-party Homebrew tap (steipete/tap/gifgrep) and a Go module (github.com/steipete/gifgrep). Neither the author nor the repositories are on the Trusted GitHub Organizations list.
- REMOTE_CODE_EXECUTION (MEDIUM): The use of 'go install' with a remote module and 'brew install' from a custom tap executes remote scripts and binary builds on the host system during the installation phase.
- INDIRECT_PROMPT_INJECTION (LOW): The skill processes untrusted data from external GIF providers. * Ingestion points: GIF metadata (titles, tags) from Giphy and Tenor APIs. * Boundary markers: Absent; the agent receives raw JSON output from the 'gifgrep --json' command. * Capability inventory: File system writes (downloading GIFs to ~/Downloads), image processing (extracting stills/sheets), and network access to GIF providers. * Sanitization: None detected in the skill definition.
- DATA_EXFILTRATION (SAFE): The skill manages API keys for Giphy and Tenor via environment variables. These are standard for the tool's functionality and no exfiltration patterns were detected.
Audit Metadata