Manga Scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 1.0.2

Overview

This skill should be reviewed before installation because it does not include the scraper it tells users to run and instead points them toward executing any matching script found under the home directory.

Do not install this as-is unless you can verify that manga_scraper.py comes from the same trusted package and is executed from a fixed reviewed path. Require confirmation before scraping, writing files, using browser fallback, or installing Playwright/Chromium, and consider pinning dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:24

Finding

Untrusted Script Discovery and Execution by Filename

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–31
Vulnerability Type: Local executable spoofing
Risk Level: High

Vulnerable Code:

bash

## Script Location

Locate the script in your skills directory:

find ~ -name manga_scraper.py 2>/dev/null

## Setup Check

python3 /path/to/manga_scraper.py --help

Technical Analysis

The project does not include the referenced manga_scraper.py script. Instead, the instructions tell the user or agent to search the entire home directory for any file with that name and then execute the discovered file with Python.

Filename-based discovery does not establish the script's provenance, ownership, integrity, or relationship to this Skill. An attacker who can create a file anywhere beneath the user's home directory can place a malicious manga_scraper.py there. If that file is selected from the search results and executed, its top-level Python code runs immediately, even when invoked only with --help.

Because multiple matching paths may be returned, the documentation also provides no deterministic or safe selection rule. This creates a local tool-spoofing opportunity in which an unrelated or attacker-controlled executable can masquerade as the expected scraper.

Attack Path

1. An attacker obtains the ability to place a file under any directory within the target user's home directory, such as through another downloaded archive, shared workspace, or compromised local process.
2. The attacker creates a malicious file named manga_scraper.py.
3. The user or agent follows the Skill instructions and runs find ~ -name manga_scraper.py.
4. The attacker-controlled file appears among the search results and is mistaken for the required Skill script.
5. The user or agent invokes the file with Python.
6. Python executes its top-level payload with the privileges of the invoking account.

Impact Assessment

Successful exploitation permits ...[truncated 486 chars]

Remediation

View remediation

Remediation Suggestions

• Include manga_scraper.py inside the reviewed Skill package rather than searching the home directory for it.
• Resolve the executable through a fixed path relative to the verified Skill directory.
• Refuse to execute a script when its resolved path falls outside the expected package directory.
• Verify the script against a pinned cryptographic hash or a trusted digital signature before execution.
• Check file ownership and reject files writable by untrusted users where the deployment model supports multiple users.
• Avoid automatically selecting the first result from a broad filesystem search.
• Document the exact expected path and fail closed if the bundled script is absent.
• Review the actual script as part of the Skill audit before distributing instructions that execute it.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned Playwright and Chromium Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–42
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

**Required for browser fallback (optional):**
```bash
pip install playwright && playwright install chromium

text

### Technical Analysis

The setup command installs the currently resolved Playwright package and associated Chromium artifacts without pinning package or browser versions. It also provides no hash verification, lock file, isolated virtual environment, or explicit trusted package index.

Consequently, installations performed at different times can resolve to different code and browser artifacts. A compromised upstream release, unsafe package-index configuration, dependency confusion condition, or unexpected incompatible update could introduce unreviewed code into the environment.

The command shown does not itself identify a malicious package or source, and the official `playwright` package name is not a typographical imitation. The risk arises from allowing mutable, unverified third-party components to be installed as part of the documented workflow.

### Attack Path

1. The user or agent enables the optional browser fallback and follows the documented setup command.
2. `pip` resolves `playwright` using the environment's configured package indexes without a pinned version or verified hashes.
3. An unsafe index configuration, compromised upstream release, or later unreviewed release supplies altered package content.
4. The installed package is imported or its command-line entry point is executed.
5. `playwright install chromium` retrieves additional mutable browser artifacts.
6. Compromised dependency code or browser components execute with the invoking user's privileges.

### Impact Assessment

A compromised dependency or downloaded browser component could execute code with the current user's privileges. Po
...[truncated 413 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Playwright to a specifically reviewed version.
• Use a dependency lock file and require cryptographic hashes for Python packages.
• Install dependencies in a dedicated virtual environment rather than the user's global Python environment.
• Specify and enforce an approved package index, such as the intended official repository, while rejecting untrusted extra indexes.
• Pin or otherwise validate the expected Chromium revision downloaded by Playwright.
• Record checksums or vendor verified browser artifacts where operationally feasible.
• Periodically review and deliberately update the pinned package and browser versions after security testing.
• Document the expected package versions and integrity values directly in the project so installations are reproducible.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger text is broad enough to activate on generic requests to download or scrape manga content, which can cause the agent to perform network access and content acquisition without clear scope limits or user confirmation. In this context, the skill is specifically designed to bypass Cloudflare and scrape a third-party site, so overbroad triggering increases the chance of unauthorized or policy-violating use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description does not prominently warn that it writes files to disk and may invoke a headless browser fallback, which changes the execution and privacy/security profile of the action. Because the skill also advertises bypassing Cloudflare and may install or use Playwright/Chromium, insufficient disclosure can lead to unexpected filesystem changes, additional software installation, and hidden network activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.