ClawHub
Back to skill

Security audit

Slack Gif Creator Anthropic

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward local GIF-making helper for Slack, with no hidden network, credential, persistence, or account-control behavior found.

This skill appears reasonable to install for local Slack GIF creation. Use it in a normal isolated Python environment, pin dependency versions or use a lock file if reproducible builds matter, and only point it at image paths you intend to read or GIF paths you intend to write.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Unpinned Dependencies

Low
Category
Supply Chain
Content
pillow>=10.0.0
imageio>=2.31.0
imageio-ffmpeg>=0.4.9
numpy>=1.24.0
Confidence
95% confidence
Finding
The dependency is specified with only a lower bound, which allows future installs to resolve to any newer version. This weakens build reproducibility and can unintentionally introduce breaking changes or newly published malicious/compromised releases into the supply chain.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pillow>=10.0.0
imageio>=2.31.0
imageio-ffmpeg>=0.4.9
numpy>=1.24.0
Confidence
95% confidence
Finding
Using an unpinned imageio dependency means installations are not reproducible and may pull in unexpected newer releases. In a package-processing skill, this increases supply-chain risk because dependency behavior can change over time without code changes in the skill itself.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pillow>=10.0.0
imageio>=2.31.0
imageio-ffmpeg>=0.4.9
numpy>=1.24.0
Confidence
95% confidence
Finding
The imageio-ffmpeg package is not pinned to a specific version, so deployments may silently consume different releases over time. Because this package interfaces with media processing components, unreviewed upgrades can increase supply-chain and stability risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pillow>=10.0.0
imageio>=2.31.0
imageio-ffmpeg>=0.4.9
numpy>=1.24.0
Confidence
95% confidence
Finding
An unpinned numpy dependency permits automatic resolution to arbitrary newer versions, reducing reproducibility and increasing exposure to supply-chain issues. Even when not directly malicious, this can lead to unexpected vulnerabilities or crashes being introduced during installation.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.