BLE → $ANIMA Minter

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Running the script can observe nearby devices during the scan window.

Why it was flagged

The script actively starts a BLE scan, which is central to the skill but means running it collects nearby Bluetooth device identifiers.

Skill content

socket = aiobs.create_bt_socket(0)
...
await protocol.send_scan_request()
print("Scanning for 10 seconds...")

Recommendation

Run it only when you intend to scan the local Bluetooth environment and are comfortable collecting nearby device identifiers.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

The local file and terminal output may retain or expose records derived from nearby Bluetooth identifiers.

Why it was flagged

Observed MACs are hashed with a fixed salt, printed in raw form to the console, and stored persistently as a local DAG file.

Skill content

SALT = "anima2026"
...
print(f"Detected MAC: {mac_str}  Hash: {h}")
...
nx.write_gpickle(G, "anima_dag.gpickle")

Recommendation

Treat anima_dag.gpickle and any terminal logs as privacy-sensitive, delete them when no longer needed, and avoid sharing them casually.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future dependency versions could behave differently from the versions the author tested.

Why it was flagged

The dependencies are not version-pinned, so installation resolves whatever package versions are current in the package index.

Skill content

aioblescan
networkx

Recommendation

Pin and review dependency versions before installing, especially for Bluetooth-access packages.