pixiv-cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 12:14 PM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for operating Pixiv, but its install path asks agents to run a mutable remote installer, which warrants review before use.

Review the install workflow before allowing an agent to install or repair pixiv-cli. Prefer a pinned release or independently verified installer where possible. Only use credential import/export, FANBOX, reverse-image upload, bookmark/follow changes, downloads, PATH changes, and MCP startup when you explicitly intend those actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/install.md:11
• Finding: Mutable Remote Installer Is Downloaded and Executed Without Independent Authentication## Vulnerability Details **File Location**: `references/install.md`, lines 11-19 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown - Unix installer: `https://github.com/FlanChanXwO/pixiv-cli/releases/latest/download/install.sh` - Windows CMD installer: `https://raw.githubusercontent.com/FlanChanXwO/pixiv-cli/main/scripts/install.cmd` Download and inspect the selected script before execution. Do not substitute a mirror, custom base URL, package copied from chat, or an improvised installer. The installer itself must select the latest stable official Release and report `SHA-256 verified` before replacing a binary. ``` ### Technical Analysis The installation workflow retrieves executable installer code from mutable remote locations. The Unix URL follows the `latest` release, while the Windows installer is retrieved from the moving `main` branch. Consequently, the code ultimately executed can change after this Skill has been reviewed. The requirement to inspect the script provides a procedural safeguard, but it does not cryptographically authenticate the installer or ensure that an automated inspection will identify a sophisticated malicious modification. Similarly, a binary checksum validated by the remotely downloaded installer is not an independent trust boundary: a compromised installer can replace both the expected checksum and the binary, falsely print `SHA-256 verified`, or execute unrelated commands before verification. Installation is necessary only when explicitly requested, and the Skill correctly limits installation to a per-user destination without administrator privileges. These controls reduce exposure and privilege, but they do not eliminate the remote-code-execution risk at the current user's privilege level. ### Attack Path 1. An attacker compromises the repository, maintainer account, release publishing credentials, or delivery pat ...[truncated 1407 chars]
• Remediation: ## Remediation Suggestions 1. Replace `latest` and `main` URLs with immutable, reviewed release versions and commit-addressed resources. 2. Publish an expected installer SHA-256 digest in a separately controlled, immutable location and verify it before invoking the script. 3. Prefer cryptographic release signatures using a pinned maintainer public key. Verify both the installer and downloaded binary against signed release metadata. 4. Do not rely on a checksum embedded in, downloaded by, or interpreted solely by the installer being authenticated. 5. Download the installer to a private temporary file, reject symlinks and unsafe permissions, verify its digest or signature, and execute the exact verified file. 6. Preserve the existing explicit-installation consent requirement, per-user destination, pre-execution disclosure, and prohibition on administrator or root privileges. 7. Pin the expected binary version and independently verify the installed binary after installation rather than trusting installer-generated text such as `SHA-256 verified`. 8. For Windows, reference an immutable commit or signed release asset instead of the moving `main` branch.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

exposes it, but cannot be combined with `--ndjson`.
4. **Opportunistic tooling:** probe once for `jq`; if present, prefer
   `--json` + `jq` for field selection. If absent, fall back to tier 3
   silently — never ask the user to install anything.
5. **Check status before parsing JSON:** `--json` controls successful output;
   it does not guarantee that usage, validation, flag, or authentication errors
   are JSON. Inspect the exit code first. On failure, expect stdout may be empty

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description at L010 scopes the skill to Pixiv operations via `pixiv-cli`, including search, rankings, bookmarks, follows, and downloads. But the body of the skill also documents a separate FANBOX service surface with authentication, creator/post/feed inspection, and its own MCP mode, which expands behavior beyond the declared Pixiv-focused scope.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Reverse search reports `challenge_required`, `solver_unavailable`, `solver_failed`, or `malformed_solver_response` | ascii2d challenge recovery is unavailable, failed, or returned an invalid JSON response | Check the optional `[reverse_search.flaresolverr]` URL and service logs. Its `proxy_url` is only the browser upstream proxy; it does not replace the native reverse-search proxy or carry the image upload |
| Wrong account acting | Multiple local accounts | `pixiv auth list --json`, then `pixiv auth use UID` (confirm first); data commands do not accept per-command account overrides. |
| `auth import` waits for hidden input the user cannot enter | Agent PTY has no direct user-input channel | Cancel the waiting command; give it to the user for their private terminal, or use an authorized secret-manager-to-stdin pipeline as described in `auth.md` |
| Cookie string rejected | By design | Only raw App API refresh tokens are accepted; for an explicit import request follow `auth.md` without asking the user to disclose an undisclosed token |

`pixiv auth list --json` only shows configured accounts. `pixiv auth check
--json` performs the network validation and prints user_id / username (never

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: The manifest describes search, inspection, rankings, recommendations, bookmark/follow management, and downloads, but does not mention account-pool administration. The cheat sheet adds `pixiv auth pool enable/disable`, which changes local account scheduling state and broadens the operational scope beyond the user-facing description.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The document uses Japanese search terms like "初音ミク" as canonical examples for both artwork and novel searches. While examples alone are mild, there is no accompanying note that users may choose their own language or locale, which can read as an implicit language preference without opt-in.

Static analysis

No suspicious patterns detected.