Anima

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:18 PM UTC
• Version: 1.2.0

Overview

The skill mostly matches its Anima app-building purpose, but it can trigger on broad build/design requests, send content to Anima, publish live sites without clear confirmation, and run an unpinned third-party CLI.

Review this before installing if you work with private designs, internal websites, secrets, or regulated data. Only use it when you intentionally want Anima's external service involved, require confirmation before publishing live URLs, avoid sending sensitive material, and run the CLI with a scoped API key in an isolated project environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:65

Finding

Unpinned Third-Party CLI Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

markdown

Use the Anima CLI (`npx @animaapp/cli`) for all operations. CLI examples are shown throughout this guide. See the [CLI documentation](https://github.com/AnimaApp/anima-cli) for authentication setup.

Technical Analysis

The Skill instructs agents to execute @animaapp/cli through npx without specifying an exact, reviewed package version or integrity value. Depending on the local npm configuration and cache state, npx can retrieve and execute the package version currently resolved by the npm registry.

This creates a supply-chain trust boundary: the effective executable code can change after the Skill has been reviewed. The command therefore does not guarantee that future invocations will execute the same code that was previously assessed.

Exploitation would require compromise or malicious modification of the package, its publisher account, or its dependency chain. No evidence indicates that the referenced package is currently malicious.

Attack Path

1. An attacker compromises the @animaapp/cli publisher account, package release process, registry artifact, or a dependency included in a future release.
2. The attacker publishes or causes resolution to a modified package version containing malicious lifecycle or runtime code.
3. An agent follows the instruction on line 65 and invokes npx @animaapp/cli.
4. npx retrieves the mutable package version from the package registry.
5. The attacker-controlled package executes with the privileges of the process running the agent.
6. The malicious code can access resources available to that process, potentially including repository files, environment variables, and configured network services.

Impact Assessment

Successful exploitation could execute arbitrary code under the invoking user's privileges. The acces ...[truncated 500 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact, reviewed version rather than resolving the latest available release:

   bash

   npx --yes @animaapp/cli@<reviewed-exact-version>
   

2. Record and verify package integrity and provenance through an npm lockfile, trusted internal registry, or equivalent artifact-verification mechanism.

3. Review the pinned package, its lifecycle scripts, and its transitive dependency tree before approving execution.

4. Configure automated dependency monitoring, but require security review before updating the pinned version.

5. Require explicit user confirmation before downloading or executing the CLI for the first time.

6. Run the CLI with least privilege in an isolated environment that exposes only the required project directory and environment variables.

7. Avoid exposing unrelated credentials to the CLI process. Supply ANIMA_API_KEY only when required and use a narrowly scoped, revocable credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger scope is very broad, covering generic requests such as design, create, build, prototype, publish, deploy, and common URL types. That makes accidental invocation likely, so the skill may take over unrelated workflows and steer agents toward external services, code generation, or deployment without sufficiently precise user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill promotes creating and publishing live applications and emphasizes fast deployment, but it does not require a clear warning or confirmation that code, assets, and app state will be sent to and hosted by an external service. In practice, this can lead to unintentional disclosure of sensitive designs or data and accidental public deployment of generated applications.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs use of npx @animaapp/cli without pinning an exact version, which causes execution of whatever package version is current at run time. In an agentic environment, this creates a supply-chain risk: a compromised upstream release or breaking update could execute attacker-controlled code or alter behavior unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.