ClawHub
Back to skill

Security audit

Find Anime

Security checks for vulnerabilities and agentic risk

Overview

This is a simple anime and manga lookup skill that makes disclosed requests to AnimeHunt and does not show hidden execution, persistence, or privileged access.

Install this if you are comfortable with anime or manga search terms being sent to AnimeHunt. Avoid including private or sensitive personal context in searches or feature feedback, since the skill does not include a separate consent step before making those requests.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill says to use it when someone asks what anime or manga to watch or read, wants details about a title, or wants the best titles of a genre or year. These activation conditions are broad natural-language descriptions rather than a constrained trigger list, and they do not include exclusions or negative examples, which could cause unintended invocation on everyday recommendation-style requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to make external HTTP requests to a third-party service but does not warn the user that their queries may be sent off-platform. This creates a transparency and privacy risk, especially when user prompts may contain personal preferences or sensitive contextual details that are unnecessary to disclose to the external site.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.