ClawHub
Back to skill

Security audit

Anime

Security checks for vulnerabilities and agentic risk

Overview

The skill is for anime lookup, but the reviewed package does not include the executable it tells agents to run and its manual install points to mutable external code.

Review or install only from a pinned, trusted release that includes the actual anime script. Avoid the manual git-clone-and-symlink path unless you inspect the script yourself and are comfortable exposing a persistent local command to your agent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:24
Finding

Unpinned External Executable Installation

Content
View full analysis

Vulnerability Details

File Location: README.md:24-34; related executable reference at SKILL.md:79
Vulnerability Type: Supply-chain risk from mutable, unverified external code
Risk Level: Medium

Vulnerable Code

README.md:24-34:

bash
### Via ClawHub
```bash
clawhub install anime

Manual

bash
git clone https://github.com/jeffaf/anime-skill.git
cd anime-skill
chmod +x scripts/anime
# Add to PATH or symlink
ln -s $(pwd)/scripts/anime /usr/local/bin/anime
text

`SKILL.md:79`:

```text
**Script location:** `{skill_folder}/anime` (symlink to `scripts/anime`)

Technical Analysis

The installation instructions retrieve executable content from mutable external sources without pinning an immutable commit or release and without verifying a checksum or cryptographic signature. The retrieved scripts/anime file is then made executable and exposed through /usr/local/bin/anime.

The audited artifact contains only README.md and SKILL.md; neither scripts/anime nor the documented anime symlink is present. Consequently, the executable installed by these instructions is outside the reviewed artifact, and its implementation cannot be validated against the documented anime lookup behavior.

This does not establish that the referenced repository or package is malicious. It creates a supply-chain trust gap in which the code ultimately executed may differ from the code that was reviewed or expected.

Attack Path

  1. An attacker compromises the external repository, its maintainer account, a mutable branch, or the package distribution channel.
  2. The attacker modifies the externally hosted scripts/anime implementation or substitutes a malicious package version.
  3. A user follows the documented clawhub install anime or unpinned git clone procedure.
  4. The user grants execute permission to the retrieved script and may link it into /usr/local/bin.
  5. A u ...[truncated 779 chars]
Remediation
View remediation

Remediation Suggestions

  1. Include the actual scripts/anime executable and intended symlink in the distributed artifact so reviewers and users can inspect the code being executed.
  2. Pin manual installation instructions to an immutable, audited commit hash or signed release tag rather than the repository's mutable default branch.
  3. Publish a SHA-256 or stronger digest for each released executable and require verification before granting execute permission.
  4. Cryptographically sign releases and document signature verification using a clearly identified maintainer key.
  5. Ensure the ClawHub package is version-pinned and reproducibly built from the same reviewed source revision.
  6. Prefer a user-local installation directory when system-wide installation is unnecessary, and avoid recommending elevated privileges.
  7. Add release automation that verifies the packaged executable matches the reviewed source and fails when expected files are missing.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.