Security audit

Otaku Wiki

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AniList anime lookup helper, but its command instructions can let crafted search text run unintended shell commands.

Review this skill before installing. Its AniList lookup purpose is straightforward, but it should be run only in a constrained environment or after updating the invocation instructions so user search terms are passed as separate arguments, not interpolated into shell command strings. Network access should be limited to AniList where possible.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:20
Finding: Shell Command Injection Through Unsafely Interpolated Search Terms
Content: View full analysis
" --top 1 - Search for anime by AniList ID: python3 "{baseDir}/anilist_cli.py" anime --id - Search for a character: python3 "{baseDir}/anilist_cli.py" character --search "" --top 1 - Search for voice actors or staff: python3 "{baseDir}/anilist_cli.py" staff --search "" --top 1 ``` The original instructions use Chinese placeholder descriptions, but the command structure above faithfully represents the affected code. ### Technical Analysis The Skill instructs the Agent to construct shell command strings by placing user-supplied search terms inside double quotes. Double quotes do not neutralize all shell syntax. In common POSIX shells, command substitutions such as `$(command)` and backtick substitutions are still evaluated inside double-quoted strings. An input containing an embedded quote may also terminate the intended argument and introduce additional shell operators. The Python implementation uses `argparse` and does not directly invoke a shell, so the flaw does not originate in `anilist_cli.py`. The vulnerable boundary is the command-construction procedure prescribed by `SKILL.md`: the shell can interpret malicious syntax before Python receives the search argument. For example, if an Agent directly substitutes a search term containing `$(attacker_command)` into the documented command, the shell executes `attacker_command` and passes its output to the Python process as part of the argument. ### Attack Path 1. An attacker submits an anime, character, or staff search term containing shell syntax, such as a command substitution expression. 2. The A ...[truncated 1442 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to run a Python script with default network access, but the manifest does not declare any tool scope, permissions, or allowed-tools restrictions. This creates an authorization gap where networked execution is available without clear least-privilege boundaries, increasing the chance of unintended outbound requests or abuse if the script or surrounding agent behavior is modified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs the assistant to always respond in Chinese without checking the user's language preference. While not a classic security bug, this can undermine user autonomy and create a policy/UX compliance issue, especially in multilingual environments where forced language choice may obscure warnings, consent, or important output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.