Security audit

Kmoe Manga Download

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it claims, but its instructions promote unsafe password handling and local command callbacks that users should review carefully before installing.

Install only if you are comfortable with the external `kmoe-manga-downloader` package and its credential handling. Avoid putting passwords on the command line, keep credential pools minimal, and do not use `--callback` with shell snippets unless you fully trust the downloaded metadata and understand what command will run locally.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:9
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
= 3.9)" ``` ```markdown > **Prerequisite**: This skill requires the `kmdr` command-line tool. Install it with: > ```bash > pip install kmoe-manga-downloader > ``` > Requires Python >= 3.9. ``` ### Technical Analysis The skill instructs users and the OpenClaw installation mechanism to install `kmoe-manga-downloader` from PyPI without specifying an exact version or cryptographic hash. The dependency's executable source is not included in the audited project, so its behavior—including credential storage, callback processing, network communication, and filesystem access—cannot be independently verified from the available artifact. An unpinned package name resolves to whichever release the package repository currently serves. Consequently, the effective code installed by the skill can change after the skill itself has been reviewed. A compromised publisher account, malicious future release, or package repository compromise could cause arbitrary installation or runtime code to execute under the user's account. No evidence establishes that the current package is malicious. The vulnerability is the unsafe, mutable dependency installation process. ### Attack Path 1. An attacker compromises the package publisher account, distribution infrastructure, or a future package release. 2. The attacker publishes a malicious version under the existing `kmoe-manga-downloader` package name. 3. A user or automated skill installer runs the documented unpinned installation. 4. Package installation hooks or the resulting `kmdr` executable run attacker-controlled code. 5. The malicious code accesses data av ...[truncated 602 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:39
Finding: Password Exposure Through Command-Line Arguments
Content: View full analysis
-p # 2. Download volumes 1-3 of a manga ``` A related command reference at `SKILL.md:51-54` also permits the password argument: ```bash # Log in (password prompted if omitted) kmdr login -u [-p ] # Check account status and download quota ``` ### Technical Analysis The Quick Start encourages users to substitute an account password directly into a command-line argument. Command-line secrets can be exposed through several local channels: - Shell history files and history synchronization - Process listings and process inspection interfaces while the command runs - Terminal session recording - Debugging, monitoring, or audit logs that capture command arguments - Copied commands stored in scripts, notes, or support transcripts The document acknowledges that the password can be prompted interactively when omitted, but the more prominent Quick Start still demonstrates the insecure `-p` form. This creates a realistic risk that users will expose actual credentials by following the example verbatim. ### Attack Path 1. A user replaces `` with a real Kmoe password and executes the Quick Start command. 2. The shell records the complete command in history, or the operating system exposes it through process metadata while it is running. 3. Another local user, monitoring process, history-sync service, log collector, or later compromise reads the stored command. 4. The attacker extracts the username and password. 5. The attacker authenticates to the Kmoe account and uses its available account capabilities and download quota. ### Impact Assessment The direct impact is disclosure of the Kmoe account credential. An attacker may access the affected account, consume i ...[truncated 345 chars]
Remediation: View remediation
` form from the Quick Start and all recommended examples. - Direct users to omit `-p` and enter the password through a non-echoing interactive prompt: ```bash kmdr login -u ``` - If automation is required, use a protected secret store or narrowly scoped credential mechanism rather than command-line arguments. - Do not recommend plaintext environment variables unless their exposure characteristics are clearly addressed. - Ensure the underlying CLI stores credentials in an operating-system credential manager or a file with restrictive permissions. - Add a warning that passwords must not be placed in shell history, scripts, logs, or support messages. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:134
Finding: Shell Callback Constructed from Untrusted Manga Metadata
Content: View full analysis
> ~/kmdr.log" ``` ``` ### Technical Analysis The example constructs a shell command containing `{b.name}` and `{v.name}`, which represent metadata obtained for externally hosted manga content. Single quotes in the callback template do not provide reliable protection if template substitution occurs before the resulting string is evaluated by a shell. For example, a crafted title containing a single quote followed by shell syntax could terminate the quoted argument and introduce a new command. If the downloader substitutes metadata text into the callback and then executes the result through a shell, the remote metadata becomes executable command syntax. The `kmdr` implementation is not included in the project, so the audit cannot verify whether it invokes a shell, escapes substituted values, or passes values as isolated process arguments. The documented interface nevertheless promotes an unsafe callback construction pattern and creates a command-injection risk whenever textual substitution is followed by shell evaluation. ### Attack Path 1. An attacker causes a manga or volume name to contain shell metacharacters, quoting characters, or command-substitution syntax. 2. A user downloads the attacker-influenced content while using the documented callback. 3. `kmdr` replaces `{b.name}` or `{v.name}` with the untrusted metadata. 4. If the substituted callback is evaluated by a shell without context-aware escaping, the ...[truncated 775 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly documents passing a password on the command line (-p <password>), which can expose credentials through shell history, process listings, terminal scrollback, and audit logs. In a skill meant to be copied verbatim by users, omitting a warning or safer alternative makes accidental credential disclosure likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill promotes a post-download --callback feature by showing a shell command example but provides no warning that callbacks execute arbitrary commands. Because callback templates interpolate metadata like book and volume names, unsafe quoting or unexpected content can turn routine automation into command-injection or destructive local command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The credential-pool section encourages managing multiple accounts for failover but does not warn about the security implications of storing and handling several credentials. This increases the attack surface: compromise of the tool's config, local files, or logs could expose multiple accounts at once rather than a single account.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.