BLE → $ANIMA Minter

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to do what it says—scan nearby Bluetooth identifiers, hash them, and store a local DAG—but that identifier collection is privacy-sensitive.

Before installing, decide whether you are comfortable scanning nearby Bluetooth devices and keeping a local hashed record of what was observed. Review and pin the Python dependencies, run the script only intentionally, and delete anima_dag.gpickle or terminal logs if you do not want to retain the collected identifiers.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Running the script can observe nearby devices during the scan window.

Why it was flagged

The script actively starts a BLE scan, which is central to the skill but means running it collects nearby Bluetooth device identifiers.

Skill content

socket = aiobs.create_bt_socket(0)
...
await protocol.send_scan_request()
print("Scanning for 10 seconds...")

Recommendation

Run it only when you intend to scan the local Bluetooth environment and are comfortable collecting nearby device identifiers.

Low

#ASI06: Memory and Context Poisoning

What this means

The local file and terminal output may retain or expose records derived from nearby Bluetooth identifiers.

Why it was flagged

Observed MACs are hashed with a fixed salt, printed in raw form to the console, and stored persistently as a local DAG file.

Skill content

SALT = "anima2026"
...
print(f"Detected MAC: {mac_str}  Hash: {h}")
...
nx.write_gpickle(G, "anima_dag.gpickle")

Recommendation

Treat anima_dag.gpickle and any terminal logs as privacy-sensitive, delete them when no longer needed, and avoid sharing them casually.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future dependency versions could behave differently from the versions the author tested.

Why it was flagged

The dependencies are not version-pinned, so installation resolves whatever package versions are current in the package index.

Skill content

aioblescan
networkx

Recommendation

Pin and review dependency versions before installing, especially for Bluetooth-access packages.