MAL Anime Tracker

Track and manage your MyAnimeList anime lists, get anime details, rankings, seasonal updates, and receive new episode notifications.

Security Scan

The skill's code, instructions, and requested secrets are consistent with a MyAnimeList (MAL) tracker: it legitimately needs MAL OAuth credentials, calls the MAL API, and notifies via OpenClaw; nothing in the package appears to perform unrelated or covert actions.

Purpose & Capability

Name/description (MAL tracking, notifications) align with required credentials (CLIENT_ID, CLIENT_SECRET, ACCESS_TOKEN, REFRESH_TOKEN), network access to api.myanimelist.net, and notify.message capability declared in manifest. There are no unrelated external services or unexpected credentials requested.

Instruction Scope

Runtime instructions focus on MAL OAuth setup, installing Python deps, and running the provided CLI commands. One minor concern: auth.py prints ACCESS_TOKEN/REFRESH_TOKEN to stdout (SKILL.md instructs capturing these), which can leak tokens into shells/logs if not handled carefully; the cron example pipes output into an openclaw message send command (expected for notification feature).

Install Mechanism

No download/install of arbitrary code; dependencies are standard Python packages (requests, python-dotenv) listed in requirements.txt. The skill is instruction+code and relies on pip installing two well-known libraries.

Credentials

Requested environment variables are limited to MAL OAuth credentials and tokens, which are required for the described functionality. No unrelated secrets, cloud credentials, or system tokens are requested.

Persistence & Privilege

always is false and the skill does not request system-wide configuration changes. It can be invoked autonomously (default), which is expected for a notifier skill and is not excessive here.

Assessment

This package appears to do what it says: it calls the MyAnimeList API and sends notifications via OpenClaw. If you install it, keep these points in mind: - You must provide MAL OAuth credentials (CLIENT_ID, CLIENT_SECRET, ACCESS_TOKEN, REFRESH_TOKEN). Store them in a secrets vault (OpenClaw vault) rather than plaintext .env when possible. - auth.py prints tokens to stdout for you to capture — avoid running it where shell history or logs are retained, or copy printed tokens into a secure vault immediately. - The cron/example sends messages using the openclaw CLI; ensure that the CLI and any chat target IDs are properly controlled (don't send tokens or other secrets in messages). - Review or run the code in an isolated environment before giving it access to production secrets. The codebase has some duplicate logic and modest quality issues, but no indicators of exfiltration to unexpected endpoints. - Optional: verify the manifest/version consistency and review logs for accidental token leakage after first run.

mal-anime-tracker Skill

Purpose

Track anime/manga lists on MyAnimeList (MAL) and receive automatic notifications via OpenClaw when new episodes are available.

Setup

1. Set the following environment variables (e.g., in your shell configuration or openclaw vault):

   ACCESS_TOKEN=your_access_token
   REFRESH_TOKEN=your_refresh_token
   CLIENT_ID=your_client_id
   CLIENT_SECRET=your_client_secret
   

2. Install dependencies:

   pip install -r requirements.txt
   

Authorization

1. Register your application on the MyAnimeList Developer Portal.
2. Generate a code_challenge (12-char alphanumeric) and navigate to the MAL OAuth2 authorization URL to get your code.
3. Run the authorization command:

   python3 auth.py authorize <CLIENT_ID> <CLIENT_SECRET> <code> <code_challenge>
   

   This will output your tokens, which you should add to your environment.

Features

• Monitor progress for anime you are currently watching.
• Query current anime/manga lists.
• Automatic token refresh.
• Search and manage personal MAL data.

CLI Reference

• python3 api.py search <query> - Search for anime.
• python3 api.py update <anime_id> <status> - Update anime status (e.g., watching, completed).
• python3 api.py delete <anime_id> - Remove anime from list.
• python3 api.py list-anime - Show your anime list.
• python3 api.py check-updates - Check for new episodes and output updates.
• python3 api.py refresh-auth - Force a token refresh using your credentials.
• python3 api.py list-manga - Show your reading list.
• python3 api.py search-forums <query> - Search MAL forums.

Automation

# Refresh token and check updates every 6 hours
0 */6 * * * python3 /path/to/skills/mal-anime-tracker/api.py refresh-auth && python3 /path/to/skills/mal-anime-tracker/api.py check-updates | xargs -I {} openclaw message send --target <CHAT_ID> --message "{}"