ClawHub
Back to skill

Security audit

Anime Drama Studio

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly an anime script and storyboard generator, but its bundled script sends prompts and an account key to a hardcoded unencrypted remote API and includes paid account/service commands.

Review this before installing. Do not submit private scripts, unpublished IP, client material, or sensitive account data unless you trust the operator and the endpoint is changed to a secure HTTPS service. Expect paid-account behavior and environment-based API key use. The included script also appears broken as published, so it may not run without fixes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is presented as an anime/drama creation tool, but it also exposes account registration, balance inquiry, and backend service access features that broaden its operational scope beyond the advertised purpose. This increases attack surface and can mislead users into providing account data or interacting with billing-related workflows they did not expect from a content-generation skill.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The services command enumerates all backend AI services, which is unnecessary for the stated anime-studio purpose and can disclose internal platform capabilities to end users. Such capability discovery can aid reconnaissance, reveal hidden or premium endpoints, and facilitate abuse of unrelated backend services.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill is framed as a broad, one-stop creative workshop with few activation boundaries, which increases the chance of unintended invocation and use outside its intended domain. Overly broad scope can cause prompt collisions with unrelated user requests, leading the agent to override more appropriate system behavior or produce unsolicited structured outputs.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger examples include very generic phrases like asking to 'write a script' or 'make a comic drama,' which overlap with common user speech and can cause accidental activation. This broad matching expands the attack surface for prompt-routing errors and may let the skill capture requests it should not handle.

Natural-Language Policy Violations

Medium
Confidence
76% confidence
Finding
The skill content is entirely in Chinese and prescribes Chinese-language interaction without offering language negotiation or documenting a justified locale restriction. While not directly a code-execution issue, this can create safety and usability failures if users misunderstand outputs, instructions, or constraints due to language mismatch.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
User-provided story ideas and the account key are transmitted to a remote backend without any meaningful disclosure, consent, or privacy notice in the script. Because creative prompts may contain sensitive or proprietary material, silent transmission to a third-party service creates confidentiality and data-handling risks.

External Transmission

Medium
Category
Data Exfiltration
Content
if method == "GET":
            resp = requests.get(url, headers=h, params=data or {}, timeout=30)
        else:
            resp = requests.post(url, headers=h, json=data or {}, timeout=60)
        if resp.status_code >= 400:
            try:
                err = resp.json()
Confidence
99% confidence
Finding
The script sends user input and authentication data to an external API endpoint, and the default endpoint uses plain HTTP to a hardcoded IP address rather than HTTPS. This enables interception or modification of prompts and API keys in transit and materially elevates the risk of credential theft and data exposure.

Static analysis

No suspicious patterns detected.