Security audit

MangaDex CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent MangaDex CLI wrapper, but it asks agents to install an unpinned global npm package and handle account secrets in command-line arguments.

Review before installing. Prefer unauthenticated public lookup use unless you need account-specific MangaDex features, avoid entering secrets into command lines or agent-visible transcripts, and only install the npm CLI after checking the package source and pinning or isolating the version where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:9
Finding: Unpinned Third-Party Package Installed Globally
Content: View full analysis
Remediation: View remediation
`. 2. Verify package provenance, publisher identity, checksums, signatures, and registry source before installation. 3. Review the pinned package and its transitive dependency tree for lifecycle scripts and known vulnerabilities. 4. Prefer a project-local or isolated installation over `npm install -g`, and execute it from a restricted environment with least privilege. 5. Use a lockfile and integrity metadata where the installation workflow supports them. 6. Disable npm lifecycle scripts with `--ignore-scripts` if the package does not require them; otherwise, explicitly audit all required scripts. 7. Document an update process requiring security review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:50
Finding: Authentication Secrets Exposed Through Command-Line Arguments
Content: View full analysis
` - `mangadexcli auth login ` - Token-only: - `mangadexcli auth set-token ` - Authorization code exchange: - `mangadexcli auth exchange --code --redirect-uri [--code-verifier ]` - `mangadexcli auth refresh` ``` ### Technical Analysis The documented authentication workflow places client secrets, passwords, access tokens, authorization codes, and PKCE code verifiers directly in command-line arguments. Sensitive values supplied this way can be exposed through shell history, terminal or agent transcripts, process inspection facilities, command auditing, telemetry, error reports, or execution logs. This risk is particularly relevant to an LLM-agent Skill because generated tool calls and their arguments may be recorded by the agent framework. Even if process arguments are visible only briefly, persistent command history or logs can preserve the credentials after the authentication command completes. The repository does not establish how the external CLI stores credentials after receiving them, so this finding is limited to disclosure caused by the documented command invocation method. ### Attack Path 1. A user provides a MangaDex password, client secret, access token, authorization code, or PKCE verifier to complete authentication. 2. The agent inserts that value directly into one of the documented command lines. 3. The command and its arguments are retained in shell history, an agent transcript, execution telemetry, or another log, or they are observed through local process inspection while the command runs. 4. A local user, administrator, monitoring component, or party with access to tho ...[truncated 874 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description presents the skill as a search/lookup tool, but the body also instructs the agent to perform authentication, client-secret storage, token setting, and login flows. This mismatch can cause users or higher-level policy systems to underestimate the skill’s access to sensitive credentials and account-scoped actions, increasing the chance of unsafe delegation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill includes credential and token management operations beyond simple public discovery/lookup, such as setting client secrets, logging in with a password, exchanging authorization codes, and refreshing tokens. Even if legitimate for some MangaDex features, these capabilities expand the blast radius from harmless read-only queries to handling reusable secrets and authenticated account access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The authentication examples place usernames, passwords, client secrets, and access tokens directly on the command line, where they may be exposed via shell history, process listings, logs, terminal transcripts, or agent telemetry. In an agent-executed skill, this is especially dangerous because secrets may be captured or replayed outside the user’s intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Several commands force --lang en, which implies the skill defaults to English-language results. Because the document does not state that English is optional or explain a justified region-specific requirement, this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.