anime-manga-research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 12:45 PM UTC
• Version: 1.0.15

Overview

This skill mostly matches its stated anime/manga lookup purpose, but its helper can send authenticated POST requests to undocumented Crawlora paths, so it should be reviewed before installation.

Install only if you are comfortable sending anime/manga lookup queries and your Crawlora API key to Crawlora. Before trusting it broadly, the helper should be tightened to GET-only routes with exact path validation so prompts or callers cannot use your key on undocumented POST endpoints.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crawlora.sh:45
• Finding: Overbroad Route and HTTP Method Authorization## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 45–74 **Vulnerability Type**: Improper route and HTTP method allowlisting **Risk Level**: Medium The helper is intended to expose only the documented, read-only anime and manga API catalog. However, it permits both `GET` and `POST` for every accepted path and uses broad shell wildcard patterns that authorize undocumented descendant routes. ```bash # This skill's helper is limited to its documented Crawlora route set. Keep # caller-account surfaces and unrelated API routes out of the helper even if # someone supplies an undocumented path directly. case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the anime-manga-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the anime-manga-research skill" >&2 exit 2 ;; esac case "$path" in /anime/airing-schedule) ;; /anime/character/*) ;; /anime/character/search) ;; /anime/rankings) ;; /anime/search) ;; /anime/title/*) ;; /anime/title/*/characters) ;; /anime/title/*/recommendations) ;; /anime/title/*/staff) ;; /manga/rankings) ;; /manga/search) ;; /manga/title/*) ;; /manga/title/*/characters) ;; /manga/title/*/recommendations) ;; /manga/title/*/staff) ;; *) echo "path is not in the anime-manga-research skill catalog" >&2 exit 2 ;; esac ``` ### Technical Analysis All 15 routes documented in `reference/endpoints.md` use the `GET` method, but the method check also permits `POST`. Method authorization is global rather than tied to each documented endpoint. The route checks are also prefix-like rather than exact route-shape validation. In Bash `case` patterns, `*` can match slash-delimited descendants. Consequently, patter ...[truncated 1911 chars]
• Remediation: ## Remediation Suggestions 1. Remove `POST` support and allow only `GET`, matching every endpoint currently documented for this Skill. 2. Validate each route against an exact shape rather than a broad descendant wildcard. 3. Restrict identifiers to their documented format, preferably numeric AniList IDs, and ensure they occupy exactly one path segment. 4. Explicitly enumerate supported child routes: `/characters`, `/recommendations`, and `/staff`. 5. Reject all trailing or additional path segments. 6. Associate allowed methods with individual routes if write operations are introduced later, rather than using a global method allowlist. 7. Add negative tests confirming rejection of: - Every `POST` request. - Extra descendant segments. - Empty or nonnumeric identifiers. - Unsupported child routes. - Paths with trailing slashes where they are not explicitly supported. 8. Preserve the fixed HTTPS base URL and private temporary credential configuration, as those existing controls limit credential exposure. A safer validation approach would use anchored regular expressions, for example: ```bash [ "$method" = "GET" ] || { echo "only GET is supported" >&2 exit 2 } if [[ "$path" =~ ^/anime/(airing-schedule|rankings|search)$ ]] || [[ "$path" =~ ^/anime/character/search$ ]] || [[ "$path" =~ ^/anime/character/[0-9]+$ ]] || [[ "$path" =~ ^/anime/title/[0-9]+(/(characters|recommendations|staff))?$ ]] || [[ "$path" =~ ^/manga/(rankings|search)$ ]] || [[ "$path" =~ ^/manga/title/[0-9]+(/(characters|recommendations|staff))?$ ]]; then : else echo "path is not in the anime-manga-research skill catalog" >&2 exit 2 fi ```

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly instructs use of a shell helper (`scripts/crawlora.sh`) but does not declare any `permissions` or `allowed-tools` scope. That mismatch weakens policy enforcement and can let the skill invoke shell/network capabilities without an explicit least-privilege declaration, increasing the risk of unintended command execution or data exfiltration if the skill is modified or reused in a broader agent environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Get a free Crawlora API key (2,000 credits/mo, no card) at [https://crawlora.net](https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills).
- Set `CRAWLORA_API_KEY` in the environment before running the helper.
- The helper reads `CRAWLORA_API_KEY` from the environment and sends requests to `https://api.crawlora.net/api/v1`. Missing/invalid key → `401`.

## How it works

• Confidence: 89% confidence
• Finding: The skill is designed to transmit data and an API credential to an external third-party service (`api.crawlora.net`). Even though it advises storing the key in an environment variable and avoiding command-line leakage, the core behavior still enables outbound network access to an external domain, which creates confidentiality and supply-chain risk if queries contain sensitive user data or if the service is compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: This markdown file says the endpoints are used via `scripts/crawlora.sh`, but it does not define any concrete trigger phrases, boundaries, or negative examples for when the skill should or should not be invoked. For markdown files, missing specificity around activation scope can create ambiguous invocation behavior, especially when paired with a general reference document.

Static analysis

No suspicious patterns detected.