bangumi-tracker

Manage Bangumi collections and track watch progress via OAuth. Use when user wants to track anime/book/game/music progress, manage wish/doing/collect lists,...

Security Scan

The skill's code, instructions, and resource usage are consistent with a local OAuth-based Bangumi collection manager; nothing in the provided files appears disproportionate or unrelated to that purpose.

Purpose & Capability

The name/description (Bangumi tracking via OAuth) matches the SKILL.md and the code: it implements OAuth, calls bgm.tv API endpoints, and stores tokens. There are no unrelated credentials, binaries, or services requested.

Instruction Scope

SKILL.md only instructs creating an OAuth app, configuring client_id/secret, running the included Python script, and using a local callback. It does not request reading unrelated files or sending data to third-party endpoints outside bgm.tv.

Install Mechanism

No install spec is provided (instruction-only + bundled Python script). That lowers installation risk; the included script is intended to be run locally and no external archive downloads or npm/go packages are pulled.

Credentials

No environment variables or unrelated credentials are required. The script stores client_secret and tokens in Windows Credential Manager (via ctypes) and on other platforms under ~/.bangumi, which is proportional for an OAuth client. One minor note: the code uses ctypes to call Windows Cred APIs and sets CRED_PERSIST_LOCAL_MACHINE (machine-level persistence), which is more persistent than per-user storage; you may want to review whether that behavior is acceptable in your environment.

Persistence & Privilege

Skill is not force-enabled (always:false) and does not request elevated platform privileges. It stores credentials only in its own config paths or the OS credential store and does not modify other skills or global agent settings.

Assessment

This skill appears to be a straightforward local OAuth client for Bangumi and is consistent with its description. Before installing or running: (1) verify the script contents yourself (especially the truncated parts) to be sure it only talks to bgm.tv and does not exfiltrate data; (2) confirm you are comfortable storing client_secret/access tokens in Windows Credential Manager or ~/.bangumi; (3) if you prefer less persistence, inspect/modify the code to change credential persistence or storage path; (4) only create an OAuth app with callback http://localhost:17321 as instructed and do not reuse high-privilege client secrets; (5) run in an isolated environment (virtualenv or VM) if you cannot verify the full source. If you want, I can scan the remainder of bangumi_tracker.py (it was truncated here) for any network calls, third-party endpoints, or obfuscated behavior.

Manage your Bangumi collections and track watch/read progress.

First Time Setup

Step 1: Create OAuth App

1. Visit https://bgm.tv/dev/app/create
2. Fill in:
   • App Name: bangumi-tracker
   • Homepage URL: http://localhost:17321
   • Callback URL: http://localhost:17321/callback
3. Get your Client ID and Client Secret

Step 2: Configure

python bangumi_tracker.py config --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET

Step 3: Authenticate

python bangumi_tracker.py auth

Opens browser for OAuth authorization.

Quick Commands

# Check status
python bangumi_tracker.py status

# List collections
python bangumi_tracker.py collections
python bangumi_tracker.py collections --type anime --status doing

# Add/update
python bangumi_tracker.py collect 428477 doing

# Remove from collection
python bangumi_tracker.py uncollect 428477

# Get progress
python bangumi_tracker.py progress 428477

# User info
python bangumi_tracker.py me

# === Character Collection ===
# Collect/uncollect character
python bangumi_tracker.py collect-character 42084 collect
python bangumi_tracker.py collect-character 42084 uncollect

# List collected characters
python bangumi_tracker.py my-characters

# === Person Collection ===
# Collect/uncollect person
python bangumi_tracker.py collect-person 12345 collect
python bangumi_tracker.py collect-person 12345 uncollect

# List collected persons
python bangumi_tracker.py my-persons

# === Episode Progress ===
# Get episode collection status
python bangumi_tracker.py episodes 428477

# Mark episode as watched/unwatched
python bangumi_tracker.py watch 123456 watched
python bangumi_tracker.py watch 123456 unwatched

Security

• Windows: Credentials stored in Windows Credential Manager
• Other platforms: Credentials stored in ~/.bangumi/
• Tokens auto-refresh when expired

More Info

• Command Reference
• API Documentation