Security audit

my skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple, disclosed scraper for a specific Hanime search page, with privacy caveats but no evidence of persistence, credential access, exfiltration, or destructive behavior.

Install only if you are comfortable with the agent making a request to hanime1.me when you ask about updates. Treat the output as a list of current search-result titles, not a reliable historical update detector.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared purpose is to check whether hanime/miuuuu/H站 has updates, but the actual behavior reportedly performs undeclared external requests to a hardcoded site and shifts into scraping/listing search-result titles for a fixed query. This mismatch is dangerous because users and agent frameworks may grant trust based on the benign description while the implementation performs broader, opaque data retrieval from external content sources.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill invokes a Python script that performs external network access, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and policy gap: an orchestrator or reviewer cannot easily constrain or understand that the skill will reach out to external sites, which can lead to unintended data flow or unsafe execution in broader agent environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger description is broad and ambiguous, causing the skill to be invoked whenever the author mentions several related terms without clear user intent boundaries. Over-broad triggering can cause unnecessary execution of a networked skill, increasing exposure to external content, unintended browsing, and privacy or compliance issues in an agent system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The skill metadata and usage documentation are entirely in Chinese, which implicitly constrains interaction and documentation to a single language without stating that this is optional or region-specific. The file does not offer a language choice or explain that the skill is intended only for a Chinese-speaking audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The request hard-codes an Accept-Language header preferring zh-CN/zh and then en, which imposes a locale preference without any user opt-in or documented reason. This is a natural-language policy concern because the skill behavior is biased toward a specific language setting rather than allowing user choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.