MangaDex CLI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:53 AM UTC
• Version: 0.1.2

Overview

The skill is a coherent MangaDex CLI wrapper, but it asks agents to install an unpinned global npm package and handle account secrets in command-line arguments.

Review before installing. Prefer unauthenticated public lookup use unless you need account-specific MangaDex features, avoid entering secrets into command lines or agent-visible transcripts, and only install the npm CLI after checking the package source and pinning or isolating the version where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9
• Finding: Unpinned Third-Party Package Installed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 9–12 and 25–26 **Vulnerability Type**: Unpinned dependency and unsafe global package installation **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: install: - kind: node package: "@mtsku/mangadex-cli" bins: [mangadexcli] ``` ```markdown 2. If missing, install: - `npm install -g @mtsku/mangadex-cli` ``` ### Technical Analysis The Skill instructs the agent to install `@mtsku/mangadex-cli` without specifying an exact package version or integrity value. Consequently, installation resolves whichever version the configured npm registry currently serves. The reviewed Skill version does not constrain the installed CLI to a previously audited release. npm packages may execute lifecycle scripts during installation. If the package, one of its transitive dependencies, its publisher account, or the package distribution channel is compromised, installing the mutable version can execute attacker-controlled code. The use of a global installation increases exposure because it places the executable in a shared command location and runs the installation with all privileges held by the invoking user. No evidence establishes that the named package is currently malicious. The vulnerability is the Skill's unsafe and mutable dependency acquisition process. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or a transitive dependency used by `@mtsku/mangadex-cli`. 2. The attacker publishes a malicious version or introduces a malicious installation lifecycle script. 3. An agent follows the Skill's availability check and determines that `mangadexcli` is absent. 4. The agent executes `npm install -g @mtsku/mangadex-cli` without a version or integrity constraint. 5. npm retrieves the attacker-controlled release and may execute its lifecycle scripts. 6. The payload runs with the invoking user's privileges and can acce ...[truncated 519 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to an audited exact version in both installation metadata and command examples, such as `@mtsku/mangadex-cli@<audited-version>`. 2. Verify package provenance, publisher identity, checksums, signatures, and registry source before installation. 3. Review the pinned package and its transitive dependency tree for lifecycle scripts and known vulnerabilities. 4. Prefer a project-local or isolated installation over `npm install -g`, and execute it from a restricted environment with least privilege. 5. Use a lockfile and integrity metadata where the installation workflow supports them. 6. Disable npm lifecycle scripts with `--ignore-scripts` if the package does not require them; otherwise, explicitly audit all required scripts. 7. Document an update process requiring security review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50
• Finding: Authentication Secrets Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 50–59 **Vulnerability Type**: Sensitive credentials passed as command-line arguments **Risk Level**: Medium ### Vulnerable Code ```markdown ## Auth Setup - Personal client login: - `mangadexcli auth set-client <client_id> <client_secret>` - `mangadexcli auth login <username> <password>` - Token-only: - `mangadexcli auth set-token <access_token>` - Authorization code exchange: - `mangadexcli auth exchange --code <code> --redirect-uri <uri> [--code-verifier <verifier>]` - `mangadexcli auth refresh` ``` ### Technical Analysis The documented authentication workflow places client secrets, passwords, access tokens, authorization codes, and PKCE code verifiers directly in command-line arguments. Sensitive values supplied this way can be exposed through shell history, terminal or agent transcripts, process inspection facilities, command auditing, telemetry, error reports, or execution logs. This risk is particularly relevant to an LLM-agent Skill because generated tool calls and their arguments may be recorded by the agent framework. Even if process arguments are visible only briefly, persistent command history or logs can preserve the credentials after the authentication command completes. The repository does not establish how the external CLI stores credentials after receiving them, so this finding is limited to disclosure caused by the documented command invocation method. ### Attack Path 1. A user provides a MangaDex password, client secret, access token, authorization code, or PKCE verifier to complete authentication. 2. The agent inserts that value directly into one of the documented command lines. 3. The command and its arguments are retained in shell history, an agent transcript, execution telemetry, or another log, or they are observed through local process inspection while the command runs. 4. A local user, administrator, monitoring component, or party with access to tho ...[truncated 874 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace command-line secret parameters with hidden interactive prompts that do not echo input. 2. Where noninteractive operation is necessary, accept secrets through protected standard input or a permission-restricted credential file rather than process arguments. 3. Avoid placing secrets in environment variables when they may be captured by diagnostics or inherited by child processes. 4. Ensure the agent framework redacts passwords, tokens, client secrets, authorization codes, and PKCE verifiers from tool calls, transcripts, logs, errors, and telemetry. 5. Disable command-history recording around authentication commands and document how users can remove any existing sensitive history. 6. Store resulting credentials using an operating-system credential manager or another encrypted secret store with least-privilege file permissions. 7. Use narrowly scoped, short-lived tokens where supported, and rotate or revoke any credential suspected of appearing in logs. 8. Update the Skill documentation so that examples never encourage users or agents to interpolate secrets directly into a shell command. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description presents the skill as a search/lookup tool, but the body also instructs the agent to perform authentication, client-secret storage, token setting, and login flows. This mismatch can cause users or higher-level policy systems to underestimate the skill’s access to sensitive credentials and account-scoped actions, increasing the chance of unsafe delegation.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill includes credential and token management operations beyond simple public discovery/lookup, such as setting client secrets, logging in with a password, exchanging authorization codes, and refreshing tokens. Even if legitimate for some MangaDex features, these capabilities expand the blast radius from harmless read-only queries to handling reusable secrets and authenticated account access.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The authentication examples place usernames, passwords, client secrets, and access tokens directly on the command line, where they may be exposed via shell history, process listings, logs, terminal transcripts, or agent telemetry. In an agent-executed skill, this is especially dangerous because secrets may be captured or replayed outside the user’s intent.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: Several commands force `--lang en`, which implies the skill defaults to English-language results. Because the document does not state that English is optional or explain a justified region-specific requirement, this is a natural-language locale policy concern.

Static analysis

No suspicious patterns detected.