Otaku Wiki

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it claims: run a local Python helper to query AniList for anime, character, and staff information, with no credentials, persistence, or hidden data handling evident.

This looks safe for normal anime/wiki lookup use. Be aware that it runs a bundled Python script and sends your search terms to AniList; make sure python3 is available because the registry metadata does not fully declare that requirement.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may run a local Python command when answering anime or character questions.

Why it was flagged

The skill intentionally gives the agent an exec-based workflow to run the bundled helper script. This is narrow and aligned with the lookup purpose, but it is still local command execution.

Skill content
exec:运行 {baseDir}/anilist_cli.py(默认联网)
Recommendation

Install only if you are comfortable with the agent running this bundled Python lookup script.

What this means

The skill may not work unless python3 is available, even though the registry requirements say no binaries are required.

Why it was flagged

SKILL.md declares a python3 requirement and the documented commands use python3, while the registry requirement section lists no required binaries. This is a metadata completeness issue rather than evidence of unsafe behavior.

Skill content
metadata: {"moltbot":{"emoji":"📚","requires":{"bins":["python3"]}}}
Recommendation

Ensure python3 is installed before use; the publisher should align registry requirements with SKILL.md.

What this means

Anime, character, or staff search terms entered by the user may be sent to AniList.

Why it was flagged

The helper sends lookup queries to AniList’s external GraphQL endpoint. This is expected for the stated no-database AniList lookup purpose.

Skill content
ANILIST_GQL = "https://graphql.anilist.co"
Recommendation

Avoid using private or sensitive text as search terms if you do not want it sent to AniList.