ClawHub
Back to skill

Security audit

AniList CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AniList CLI wrapper, with ordinary credential and third-party install risks users should handle carefully.

Before installing, confirm you trust the npm package and consider pinning the CLI version. Treat the AniList token like a password: do not paste it into shared chats, logs, commits, or visible terminal history, and only allow write actions when you explicitly want the agent to update your AniList account.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding
Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 9-12 and 22-25 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: node package: "@mtsku/anilist-cli" bins: [anilistcli] ``` ```markdown 1. Check availability: - `command -v anilistcli` 2. If missing, install: - `npm install -g @mtsku/anilist-cli` ``` ### Technical Analysis The skill directs the agent to install `@mtsku/anilist-cli` without specifying an exact version or package integrity hash. Consequently, npm resolves the package version available under the configured registry and distribution tag at installation time. The effective executable can therefore change after this skill has been reviewed. The package is also installed globally. A global npm installation may execute package lifecycle scripts and place executables in shared user- or system-level locations. The dependency's source and lifecycle behavior are not included in the audited project, which contains only `SKILL.md`; therefore, the installed implementation cannot be verified from this artifact. This finding does not establish that the named package is malicious. The vulnerability is the unsafe, mutable dependency acquisition process and its exposure to package-account compromise, registry compromise, or a malicious future release. ### Attack Path 1. An attacker compromises the npm package, its publisher account, its release pipeline, or the registry response used by the host. 2. The attacker publishes a malicious version under the package's default distribution tag. 3. An agent loads this skill on a host where `anilistcli` is unavailable. 4. Following the documented procedure, the agent executes: ```bash npm install -g @mtsku/anilist-cli ``` 5. npm retrieves the attacker-controlled release and may execute its lifecycle scripts during installation. 6. The installed executable subsequently runs with the privileges and envir ...[truncated 1098 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact, reviewed version in both the installation metadata and command: ```yaml package: "@mtsku/anilist-cli@0.3.2" ``` ```bash npm install -g @mtsku/anilist-cli@0.3.2 ``` 2. Verify package integrity against a trusted, review-controlled checksum or lockfile before installation. Do not rely only on a mutable npm distribution tag. 3. Prefer a project-local installation over a global installation: ```bash npm install --save-exact @mtsku/anilist-cli@0.3.2 ``` Invoke the reviewed local binary through a controlled wrapper or package script. 4. Review the package source, transitive dependencies, and lifecycle scripts before approval. Repeat this review before updating the pinned version. 5. Where compatible with the reviewed package, suppress installation scripts: ```bash npm install --ignore-scripts --save-exact @mtsku/anilist-cli@0.3.2 ``` 6. Configure npm to use an explicitly approved registry and enforce organizational package allowlists or provenance verification. 7. Run the CLI under a minimally privileged account or sandbox with restricted filesystem and network access. 8. Keep AniList tokens out of command histories and logs, grant only necessary API permissions, and isolate credentials from dependency installation processes. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users or agents to set an AniList auth token but does not explicitly identify the token as sensitive secret material or warn against exposing it in logs, shell history, transcripts, or shared outputs. In an agent-executed CLI context, this is dangerous because commands may be echoed, stored, or observed by other systems, leading to credential leakage and unauthorized access to the user's AniList account.

Static analysis

No suspicious patterns detected.