Anime Meme Collector

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:57 AM UTC
• Version: 0.1.0

Overview

The skill’s meme-collection purpose is mostly disclosed, but it asks users to create a persistent scheduled job that runs local code with network and file-write access and the collector disables HTTPS verification.

Install only if you want a Chinese internet anime/meme trend database and are comfortable with outbound requests to Bilibili and Zhihu plus local updates to the bundled JSON database. Do not enable the daily cron/OpenClaw job unless you intentionally want persistent automatic execution; if enabled, use absolute paths, a low-privilege account, and a documented way to disable it. The collector should also be fixed to use normal HTTPS certificate verification before relying on fetched content.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:27

Finding

Recurring Cross-Session Execution Through Scheduled Tasks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27-48; equivalent instructions also appear in SKILL.zh.md:27-48
Vulnerability Type: Scheduled task persistence
Risk Level: High

Vulnerable Code

bash

0 0 * * * cd /path/to/skill && python scripts/collect_memes.py

json

{
  "action": "add",
  "job": {
    "name": "daily-anime-meme-collect",
    "schedule": { "kind": "cron", "expr": "0 0 * * *", "tz": "Asia/Shanghai" },
    "payload": {
      "kind": "systemEvent",
      "command": "python scripts/collect_memes.py"
    }
  }
}

Technical Analysis

The Skill documentation instructs the user or Agent to register either an operating-system cron entry or an OpenClaw cron job. Both mechanisms survive the initial Skill run and invoke scripts/collect_memes.py automatically every day.

This creates a persistent execution path whose effective behavior depends on the future contents of the script and its containing directory. The cron example also uses a relative script path after changing into /path/to/skill, while the OpenClaw example executes a relative path without explicitly defining a trusted working directory. If an attacker can later modify the script, replace a path component, or influence the scheduler's working directory, attacker-controlled Python code could be executed during a subsequent unattended run.

The reviewed instructions do not themselves demonstrate privilege escalation or unauthorized script replacement. The risk arises from creating recurring cross-session execution and from the scheduler continuing to trust mutable project content.

Attack Path

1. A user or Agent follows the automated-update instructions.
2. A persistent cron or OpenClaw scheduled job is registered.
3. The job remains active after the original interaction ends.
4. The scheduler automatically invokes collect_memes.py each day.
5. If an attacker subsequently gains writ ...[truncated 769 chars]

Remediation

View remediation

Remediation Suggestions

• Make one-time manual execution the default behavior.
• Require explicit, informed user approval before creating any recurring job.
• Explain the execution frequency, network destinations, modified files, scheduler identity, and persistence implications before installation.
• Use an absolute, canonical path to a root-owned or otherwise non-writable script rather than relying on the current working directory.
• Run the task under a dedicated, least-privileged account with narrowly scoped filesystem and network access.
• Avoid a privileged OpenClaw systemEvent when a restricted job type is available.
• Pin or integrity-check the executable script before each run.
• Document commands for listing, disabling, and permanently removing the scheduled job.
• Apply the same corrections to both SKILL.md and SKILL.zh.md.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/collect_memes.py:15

Finding

HTTPS Certificate and Hostname Verification Disabled

Content

View full analysis

Vulnerability Details

File Location: scripts/collect_memes.py:15-20
Vulnerability Type: Improper TLS certificate validation
Risk Level: Medium

Vulnerable Code

python

def create_ssl_context():
    """创建SSL上下文，忽略证书验证（用于某些环境）"""
    context = ssl.create_default_context()
    context.check_hostname = False
    context.verify_mode = ssl.CERT_NONE
    return context

This context is supplied to the Bilibili and Zhihu HTTPS requests:

python

context = create_ssl_context()

with urllib.request.urlopen(req, timeout=15, context=context) as response:
    data = json.loads(response.read().decode('utf-8'))

Technical Analysis

Setting check_hostname to False disables verification that the certificate belongs to the requested host. Setting verify_mode to ssl.CERT_NONE disables certificate-chain authentication entirely. Consequently, the HTTPS connection provides encryption without authenticating the remote server.

An attacker able to intercept or redirect network traffic can present an arbitrary certificate and impersonate the configured Bilibili or Zhihu API endpoint. The script will accept forged JSON responses, extract strings from them, and persist those strings in references/anime_memes_db.json.

The Skill documentation directs an Agent to consult this database and naturally incorporate its contents into later responses. Therefore, forged API content can poison the local dataset and may include misleading or instruction-like strings. The reviewed code does not directly execute response content as code, so direct remote code execution is not established.

Attack Path

1. The collector runs on a hostile or compromised network, or DNS/routing is manipulated.
2. The attacker intercepts a request to a configured HTTPS API.
3. The attacker presents an untrusted certificate and returns crafted JSON matching the expected response structure.
4. The disabled TLS checks all ...[truncated 899 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the insecure custom SSL context and rely on Python's default certificate and hostname verification:

python

with urllib.request.urlopen(req, timeout=15) as response:
    data = json.loads(response.read().decode("utf-8"))

• If a private certificate authority is required, create a verified context and load only the required CA bundle with SSLContext.load_verify_locations().
• Never use ssl.CERT_NONE or disable hostname checking as a compatibility workaround.
• Keep the host certificate store current and fail closed when validation fails.
• Validate the response schema and impose strict type and length limits on externally supplied strings before persistence.
• Mark collected content as untrusted data when it is later supplied to an AI Agent, and ensure it cannot be interpreted as operational instructions.
• Consider atomic database writes and integrity metadata so interrupted or anomalous updates cannot silently replace the last known-good dataset.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises and operationalizes code execution with network access and file read/write behavior, but it does not declare any explicit tool scope or permissions boundary. This creates an authorization ambiguity where an agent may overgrant capabilities to a skill that performs scheduled external fetching and local database updates, increasing the chance of unintended data access or unsafe execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description uses broad activation criteria like 'use when user wants to stay updated' or 'improve AI's anime/meme knowledge,' which are vague and could cause the skill to trigger in ordinary conversation without clear user intent. Because the skill performs automated collection and updates, overbroad invocation can lead to unnecessary network activity, file modification, or execution of scheduled tasks in contexts where the user did not explicitly request them.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is explicitly centered on Chinese internet platforms and culture, but the description does not indicate that this locale-specific behavior should occur only with user awareness or opt-in. In practice this can cause the agent to apply culturally or linguistically scoped data collection and output assumptions to users who did not request Chinese-language sources, reducing transparency and potentially surprising users with external retrieval behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises automatic collection from Bilibili and other platforms and building a local database, but it does not clearly surface to the user that using the skill may trigger outbound network access and persistent local file writes. This creates a transparency and consent problem: users or operators may invoke the skill without realizing it performs scheduled external fetching and modifies local state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a skill for collecting anime/ACG memes and otaku-culture trends, but the stored dataset includes entries such as a death-in-Iran news phrase at L036, with similar non-anime topical phrases also appearing elsewhere (for example L060, L100, L126, L134). This indicates the skill's actual managed content is broader than the declared anime-community scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest frames the skill as enhancing understanding of anime/otaku culture, but a substantial portion of the file is dedicated to streamer nicknames, livestream jargon, esports fandom labels, and League of Legends terminology. While adjacent internet culture may overlap, this volume of non-anime gaming/streamer content materially broadens the behavior beyond the stated anime/ACG focus.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The module docstring presents the skill name and behavior only in Chinese, which can amount to a language-policy violation when the skill does not provide user opt-in or an explicit locale constraint. The audit criteria for SQP-3 apply to natural-language strings in code files as well as documentation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The script makes HTTPS requests to external services while globally disabling TLS certificate verification in its SSL context. This allows a man-in-the-middle attacker to spoof Bilibili or Zhihu responses, inject arbitrary content into the meme database, and undermine the integrity of downstream systems consuming that data.

Content

Scanner excerpt · scripts/collect_memes.py (reported line 25)May include surrounding context.

python

def fetch_bilibili_trending():
    """获取B站热门视频标题和标签"""
    try:
        url = "https://api.bilibili.com/x/web-interface/ranking/v2?rid=0&type=all"
        headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
            'Referer': 'https://www.bilibili.com'

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a tool for anime/ACG meme collection to improve understanding of otaku culture. However, this code adds a large hardcoded keyword set for streamer, esports, and general barrage/chat slang that is not limited to anime/ACG, expanding the database beyond the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

文档要求“在午夜运行（北京时间）”，且整体说明固定为中文互联网场景，没有提供可选语言或本地化配置。对于通用技能说明，这种默认固定语言/时区而无用户选择，可能构成自然语言层面的 locale 限制。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This manifest-style JSON file consists overwhelmingly of Chinese-language meme entries and Chinese source categories, which indicates a locale-specific skill dataset. Under the policy, forcing a specific language or locale without opt-in or documented justification can be a natural-language policy concern, and this file contains no visible indication of user choice or region-specific scoping.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 67% confidence

Finding

The skill content and usage instructions are fully Chinese-language, and there is no natural-language note offering an alternative language or making the locale expectation explicit. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file states that it is automatically updated every day and lists external data sources such as B站热门视频标题 and 知乎热榜. For a markdown file, this is a behavior that touches network/data collection, but the description does not include any user-facing warning about external access or fetched content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest emphasizes automatic daily collection of trending memes and phrases from online platforms. In addition to fetching live data, the code bulk-loads extensive fixed galgame keyword lists, which is more like curated seeding than trend collection and changes the behavior from pure collection to manual taxonomy injection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.