Anime Download Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 0.3.3

Overview

This skill is purpose-aligned for anime torrent search/downloads, but it asks users to execute mutable third-party code and uses public torrent infrastructure with limited warning.

Review this skill before installing. Only use it where torrent downloads are legal and allowed by your network policy, assume torrent activity may expose your IP address, and avoid running the documented curl-to-sh or unpinned uvx/pipx commands unless you trust and verify the upstream tool version.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Mutable Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code:

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The installation instructions retrieve a mutable shell script from an external URL and pipe its contents directly into sh. The script is executed before the user or agent can inspect it, and the command provides no version pinning, cryptographic signature verification, or checksum validation.

HTTPS authenticates the server connection under ordinary conditions but does not establish that the script is immutable or safe. The effective payload can change after this Skill has been reviewed. Compromise of the hosting domain, its deployment infrastructure, DNS or certificate ecosystem, or the upstream installer could therefore turn this documented prerequisite step into arbitrary code execution.

This behavior exceeds the minimum privileges necessary for the declared anime search and download functionality. The Skill only needs an available package runner; it does not inherently need permission to retrieve and execute an unrestricted installation script. The apparent use of Astral's documented domain reduces the likelihood of abuse but does not remove the remote execution risk.

Attack Path

1. A user asks the agent to search for or download anime content.
2. The agent follows SKILL.md and checks whether uvx is installed.
3. If uvx is unavailable, the agent executes the documented curl | sh command.
4. The response from https://astral.sh/uv/install.sh is sent directly to the shell without local review or integrity validation.
5. If the remote delivery source or installer has been compromised, attacker-controlled shell commands execute with the privileges of the user running the agent.
6. Those commands could access user-readable files, modify shell config ...[truncated 741 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh instruction and treat uv or uvx as an explicit prerequisite that users install separately through a trusted system package manager.
2. If automated installation is required, pin an audited release rather than retrieving a mutable installer endpoint.
3. Download the installer or release artifact to a local file without executing it immediately.
4. Verify a publisher-provided cryptographic signature or a trusted, version-specific SHA-256 checksum before execution.
5. Allow the user to inspect and explicitly approve the downloaded artifact.
6. Run installation with ordinary user privileges and do not recommend sudo unless a separately justified operation requires it.
7. Document the exact files and directories the installation is expected to modify.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Package Is Retrieved and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-19, with runtime invocations at lines 26, 31, 37, 44-45, 51-52, and 57; also referenced in README.md, line 16
Vulnerability Type: Unpinned third-party dependency and runtime package execution
Risk Level: Medium

Relevant Code:

bash

# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Or use pipx as fallback
pipx install anicatch && anicatch --search "KEYWORD"

Runtime examples repeatedly execute the unpinned package:

bash

uvx anicatch --seasons
uvx anicatch --season
uvx anicatch --search "Demon Slayer"
uvx anicatch --download "https://miobt.com/show-xxx.html"
uvx anicatch --search "Demon Slayer" --download --index 0

README.md also documents the mutable fallback dependency:

markdown

- Or `pipx install anicatch` as fallback

Technical Analysis

The Skill delegates all substantive functionality to the external anicatch package. Both uvx anicatch and pipx install anicatch resolve a package without an exact version, hash, lock file, or other integrity constraint.

uvx may retrieve the currently resolved package and dependencies and then execute its entry point. The pipx fallback similarly installs the current resolved release before running it. Consequently, the code executed by the Skill can change independently of the reviewed repository.

The repository contains only documentation and does not include the anicatch implementation or dependency metadata needed to audit the package behavior. There is no evidence in the reviewed files that the current package is malicious. The confirmed weakness is that future package releases or transitive dependencies are trusted and executed without a reviewable version or integrity boundary.

Attack Path

1. An attacker compromises the upstream anicatch publisher account, package repository, release process, or one of its resolved depen ...[truncated 1391 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin anicatch to an exact release that has been reviewed, such as anicatch==X.Y.Z, rather than resolving the latest available version.
2. Record and verify package and transitive-dependency hashes using an appropriate lock file or requirements file with hash enforcement.
3. Update every uvx example to use the audited version constraint supported by the selected tooling.
4. Configure package retrieval to use the expected official index and document the verified publisher and source repository.
5. Review dependency changes before updating the pinned release, including installation hooks and transitive packages.
6. Run the tool without administrative privileges and, where practical, isolate it in a restricted environment with access only to the required network destinations and chosen output directory.
7. Clearly inform users that BitTorrent functionality uses DHT and public trackers and therefore exposes their network address to torrent peers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping network output directly to sh is a classic command-chaining abuse pattern that removes any inspection barrier between untrusted remote content and code execution. In a skill file, this is especially severe because it operationalizes one-step arbitrary code execution and conditions users to trust live internet content as shell commands.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

bash

# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Or use pipx as fallback
pipx install anicatch && anicatch --search "KEYWORD"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explicitly promotes searching for and downloading anime torrents but provides no warning about legal exposure, malware risk from torrent ecosystems, or privacy implications such as IP address disclosure to peers. In a skill intended to automate agent behavior, this omission increases the chance that users invoke risky or unlawful actions without informed consent.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Claude Code
clawhub install anime-download-skill --dir ~/.claude/skills

# Manual install
git clone https://github.com/isongxw/anime-download-skill.git ~/.agents/skills/anime-download-skill

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is overly broad, covering generic anime-related terms such as search/download anime and magnet-related queries. That can cause the skill to activate in contexts where the user did not clearly request torrenting, increasing the chance that risky external-tool and P2P actions are proposed or executed unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill lacks a clear warning that using it downloads torrent files and engages public BitTorrent/DHT/tracker networks, which exposes the user's IP address and may have legal, privacy, or policy implications. In this context, omission of that warning materially increases the risk of uninformed consent for potentially sensitive network activity.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill repeatedly instructs the agent/user to run uvx anicatch without pinning a specific version or digest, so execution will resolve whatever package version is current at runtime. That creates a supply-chain risk where a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This command invokes uvx anicatch without version pinning, meaning the package and its transitive dependencies can change between runs. In an agent skill, that is especially dangerous because it normalizes executing mutable third-party code fetched at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using uvx anicatch unpinned allows silent package substitution or malicious updates to be executed when the skill is used. Because the command is positioned as routine browsing functionality, users may run it without appreciating that it executes network-fetched code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The unpinned uvx anicatch invocation exposes the environment to supply-chain compromise and arbitrary code execution if the package or dependencies are altered upstream. The risk is amplified here because the skill encourages use with user-provided search terms, increasing routine invocation frequency.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This example again executes mutable third-party code via uvx with no version pinning or integrity control. If the upstream package is compromised, the skill becomes a delivery path for malicious code under the guise of a download helper.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

An unpinned runtime fetch-and-execute pattern is a genuine supply-chain vulnerability, not merely a best-practice issue. The skill content encourages repeated execution of the package for downloads, so any malicious upstream change could directly impact the host filesystem and network activity.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The command uses uvx anicatch without constraining the version, allowing whatever code is current in the registry to run on demand. In a skill intended to be triggered by broad anime-related requests, that broadens the attack surface and raises the likelihood of accidental execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs unpinned execution of a third-party package for downloading content, which means a malicious or trojaned update could execute arbitrary code with the user's privileges. The download-oriented context also implies filesystem writes and network access, increasing potential blast radius.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This is another instance of mutable package execution through uvx, creating a realistic pathway for upstream package compromise to affect users. Since the command writes to a chosen output directory, a malicious package could abuse that trust to alter files or exfiltrate data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Running uvx anicatch without version pinning remains a true supply-chain risk in this seasonal download flow. The skill context makes it more dangerous because it is presented as a normal, repeatable action tied to common user requests, increasing the chance of execution.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The instruction fetches an installation script from the internet and pipes it directly into shell execution. This is dangerous because any compromise of the remote host, TLS termination, CDN path, or published script content results in immediate arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

bash

# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Or use pipx as fallback
pipx install anicatch && anicatch --search "KEYWORD"