[odina101]

Plugin Submission

Plugin information

• Author: rowixgroup (Rowix)
• Plugin name: gifsnap — GifSnap
• Version: 0.1.3
• Source repository: https://github.com/rowixgroup/gifsnap-dify
• Contact: https://github.com/rowixgroup/gifsnap-dify/issues

Submission type

• New plugin
• Version update

What changed

Fix the outdated, undersized lightning icon on the existing GifSnap listing. Replace the bundled icon with the current black-and-lime GifSnap logo, reused byte-for-byte from the official 512×512 app asset. The manifest and provider both use this icon.

This is a publisher-requested branding correction. The package version must change to update its bundled asset; no new capability is claimed. Compared with 0.1.2, only _assets/icon.png and the version fields in manifest.yaml, pyproject.toml and uv.lock differ. Runtime code, dependencies, permissions, privacy and API behavior are unchanged.

Old bundled icon	Updated bundled icon

Risk level

• Low risk
• Medium risk
• High risk

The existing tool sends the caller's short search topic to the fixed GifSnap HTTPS API.

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read the Plugin Development Guidelines. This submission corrects an obsolete listing icon; no new capability is claimed.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md, referenced by manifest.yaml.
• All user-facing text is primarily in English.

Security and privacy notes

No new capabilities. Bounded read-only requests only to https://gifsnap.com/api/v1/gifs/search. No arbitrary URL fetching, shell/code/SQL execution, SSH, browser automation, external posting, payments, credentials or persistent storage. Media URLs are returned, not downloaded. Callers must not include private conversations, secrets or personal information in search topics. TLS verification remains enabled.

Local validation

• All 36 existing offline tests passed. No production GIF searches.

• The exact archive loads in official Dify CLI 0.6.11. Provider validation passes; invalid input is rejected.

• Online Marketplace Toolkit validation: zero blocking or execution failures, no known vulnerabilities reported in the pinned dependency set.

• Archive comparison: exactly the icon and three version-metadata files differ. Locked third-party packages are identical.

• The 512×512 PNG matches the current official GifSnap app asset.

• Package SHA256: 9153c1fb1f4d4dfc8cbcf81fb3a0dbabebc08bffcfbac023e21a091db76cd023 (51,627 bytes).

Reviewer notes

Full Dify Cloud/Community installation was not repeated for this asset-only update. Signed 0.1.2 host verification remains historical evidence. The existing signed workflow example stays pinned to 0.1.2 until a new signed Marketplace identifier exists. No signature policy was weakened.

Source commit: rowixgroup/gifsnap-dify@226637f

[crazywoola]

Pre Check Plugin and PR Risk Label passed for this revision. Inspected the package, documentation and relevant source: this is a non-draft plugin submission with no Web3 functionality identified. This is an eligibility review, not a comprehensive security audit.