ClawHub
Back to skill

Security audit

bangumi-explorer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Bangumi lookup helper that contacts bgm.tv and keeps a limited local cache, with no evidence of credential access or unrelated behavior.

Before installing, understand that Bangumi queries will be sent to bgm.tv and responses may be cached locally in ~/.bangumi/cache/. Avoid sensitive search terms on shared machines and clear that cache if local privacy matters.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises networked querying and instructs use of a Python script that reads/writes a cache under the user's home directory, yet no permissions are declared. This creates an authorization/transparency gap: users and host systems are not clearly informed that the skill performs network access and persistent local writes.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The described scope omits behavior that materially changes the skill's footprint: persistent cache writes in the user's home directory and additional data retrieval functions like character search and broadcast calendar. Description/behavior mismatches reduce informed consent and can cause the skill to be allowed in contexts where undeclared persistence would otherwise be scrutinized.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The instructions direct the agent to run a local Python script via exec and note that it writes cache files, but provide no user-facing warning, confirmation step, or safety boundaries. Executing local code and writing persistent files without disclosure increases the risk of unexpected side effects and makes abuse or accidental misuse harder for users to detect.

Static analysis

No suspicious patterns detected.