Security audit
Security checks for vulnerabilities and agentic risk
The skill’s account access, downloads, and optional server features match its purpose and require clearly scoped user authorization.
Protect plaintext credential exports and prefer private stdin or secret-manager imports. Approve exact account actions and download destinations, and share only images you intend SauceNAO or ascii2d to receive. Remote MCP access needs trusted clients. This review covers the bundled instructions, not downloaded executables.
Referenced artifact was not completely inspected
| MCP startup, tool selection, Gallery, or media delivery | [mcp.md](references/mcp.md) |
Referenced artifact was not completely inspected
For MCP startup, tool selection, Gallery or media delivery, read [mcp.md](references/mcp.md) before acting. `pixiv mcp` defaults to local stdio; only explicit `
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Pool enabled/strategy settings are configuration; schedulable accounts are managed by `auth pool status|enable|disable`. Reads/downloads may use the pool, but mutations must not be silently assigned to a different account. Removed settings fail explicitly; use the authorized cleanup described in `auth.md`, not an automatic account migration.
FANBOX is separate: use `pixiv fanbox --help` and its read-only creator/post/tag/feed/resource capabilities. Importing `FANBOXSESSID` with `pixiv fanbox auth import` or selecting an account with `pixiv fanbox auth use --auto`/an explicit UID is a separately authorized credential/state action, not automatic preflight. FANBOX MCP does not reuse the Pixiv pool. Its optional challenge-only solver does not carry ordinary API/resource traffic or receive the session; never send the session to a non-first-party host.
## Search and identity traps
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Pool enabled/strategy settings are configuration; schedulable accounts are managed by `auth pool status|enable|disable`. Reads/downloads may use the pool, but mutations must not be silently assigned to a different account. Removed settings fail explicitly; use the authorized cleanup described in `auth.md`, not an automatic account migration.
FANBOX is separate: use `pixiv fanbox --help` and its read-only creator/post/tag/feed/resource capabilities. Importing `FANBOXSESSID` with `pixiv fanbox auth import` or selecting an account with `pixiv fanbox auth use --auto`/an explicit UID is a separately authorized credential/state action, not automatic preflight. FANBOX MCP does not reuse the Pixiv pool. Its optional challenge-only solver does not carry ordinary API/resource traffic or receive the session; never send the session to a non-first-party host.
## Search and identity traps
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
go install github.com/FlanChanXwO/pixiv-cli/cmd/pixiv@vX.Y.Z
Require the tag's declared Go toolchain, cgo, a target C linker and committed native library. Frontend sources are embedded directly; no generation or npm step is needed. State the `GOBIN`/`GOPATH/bin` destination before installing. Go-installed binaries self-update to the selected exact Release tag; failure preserves the prior executable. Do not change installation channels to work around a build failure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
e | Check the optional `[reverse_search.flaresolverr]` URL and service logs. Its `proxy_url` is only the browser upstream proxy; it does not replace the native reverse-search proxy or carry the image upload |
| Wrong account acting | Multiple local accounts | `pixiv auth list --json`, then `pixiv auth use UID` (confirm first); data commands do not accept per-command account overrides. |
| `auth import` waits for hidden input the user cannot enter | Agent PTY has no direct user-input channel | Cancel the waiting command; give it to the user for their private terminal, or use an authorized secret-manager-to-stdin pipeline as described in `auth.md` |
| Cookie string rejected | By design | Only raw App API refresh tokens are accepted; for an explicit import request follow `auth.md` without asking the user to disclose an undisclosed token |
`pixiv auth list --json` only shows configured accounts. `pixiv auth check
--json` performs the network validation and prints user_id / username (never
No suspicious patterns detected.