Anime Download Skill

• Verdict: Pass
• Analyzed: May 12, 2026, 2:36 PM
• Findings: 0
• Version: 0.3.3
• Hash: 4a98ee30e3ade6f4c02b7da5dbdeb1f196d3271f297d866531235d3ac699ad8b
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: anime-download-skill Version: 0.3.3 The skill instructions in SKILL.md direct the agent to execute a high-risk `curl | sh` command to install the `uv` tool from `astral.sh`. While this is the official installation method for a legitimate utility, executing remote scripts directly in a shell is a significant security risk for automated agents. Additionally, the skill relies on `uvx` to fetch and execute the `anicatch` package from PyPI, which introduces supply chain risks, and facilitates BitTorrent downloads involving unverified peer-to-peer network connections.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

NoteHigh Confidence

What this means

Installing or running the tool may execute third-party code and modify the user's local package/cache environment.

Why it was flagged

The skill's setup path can execute a remote installer and install/run an unpinned external package whose code is not included in the reviewed artifacts. This is disclosed and purpose-aligned, but supply-chain trust is delegated to external sources.

Skill content

curl -LsSf https://astral.sh/uv/install.sh | sh ... pipx install anicatch && anicatch --search "KEYWORD"

Recommendation

Install uv and anicatch only from trusted sources, consider pinning or reviewing the package, and require user approval before first-time setup.

ASI02: Tool Misuse and Exploitation

NoteHigh Confidence

What this means

Downloads may create local files and BitTorrent activity may expose network metadata such as the user's IP address to peers or trackers.

Why it was flagged

The skill exposes user-directed download commands that fetch torrent content and write files locally. This matches the stated purpose, but it is a meaningful external-network and filesystem action.

Skill content

`--download "URL"` — download torrent directly from a detail page URL ... `uvx anicatch --download "https://miobt.com/show-xxx.html" -o ~/Downloads`

Recommendation

Confirm each download, choose an appropriate output directory, and only download content from sources the user trusts and is allowed to use.