ClawHub
Back to skill

Security audit

Anime Finder

Security checks for vulnerabilities and agentic risk

Overview

This anime download helper is mostly coherent, but it can automatically queue torrents and start a persistent Transmission daemon from natural-language requests without a clear confirmation gate.

Install only if you are comfortable with a skill that can contact Bangumi and Nyaa, write local preference/status files, start Transmission, and queue torrent downloads. Prefer search-only or cli-only/magnet mode unless you explicitly want automatic downloading, and review/disable high-confidence auto-download behavior before using it on a machine where legal, bandwidth, or disk side effects matter.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if _run_command(["pgrep", "-x", "transmission-daemon"]).returncode != 0:
        os.makedirs(os.path.expanduser("~/.transmission"), exist_ok=True)
        subprocess.Popen(
            [
                "transmission-daemon",
                "--config-dir",
Confidence
83% confidence
Finding
The workflow can silently start a background transmission-daemon process and point it at a download directory without explicit runtime confirmation. In an agent skill, spawning long-lived background processes increases risk because a natural-language request can lead to persistent local side effects beyond a simple search operation.

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill exposes shell, network, and file read/write capabilities while declaring no permissions, which prevents users or the platform from understanding the true execution and data-access surface. In this skill’s context, those capabilities are directly tied to searching remote indexes, persisting state, and potentially queueing downloads, so undeclared capability scope meaningfully increases risk of unexpected actions and weakens policy enforcement.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented purpose frames the skill as an anime finder/downloader helper, but the broader behavior includes external identity verification, persistent user profiling, and local state tracking that are not clearly disclosed. This mismatch is dangerous because users and calling agents may route sensitive or ambiguous requests into the skill without realizing it stores preferences and operational history or applies hidden filtering logic that affects outcomes.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README explicitly promotes high-confidence auto-download behavior and documents persistent writes to local state, but it does not pair those behaviors with a clear warning about network activity, disk writes, or downloader side effects. In an agent setting, that omission increases the chance that users or integrators trigger downloads or state changes without realizing the skill can take external actions automatically.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The manifest uses broad activation phrases such as handling raw utterances, aliases, shorthand, and mixed-language requests, which can cause the skill to trigger on loosely specified user intent. In a skill that can progress from search to download or torrent queueing, overbroad routing raises the chance of unintended invocation and accidental high-impact actions from casual or ambiguous requests.

Missing User Warnings

High
Confidence
95% confidence
Finding
The documentation advertises finding releases and handling requests end-to-end but does not clearly warn that some requests may initiate downloading or queue torrents. That omission is especially risky here because the workflow supports direct download behavior and status tracking, so users may unintentionally trigger network transfers or local downloader actions when they expected search-only results.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The default prompt uses very broad trigger phrases, including raw user utterances and mixed-language shorthand, without clear limits on when the skill should activate. This can cause the agent to invoke a download-capable skill for loosely related requests, increasing the chance of unintended tool use, privacy issues, or unsafe content acquisition workflows.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The prompt is written to steer usage through Chinese-language trigger phrases without indicating that language should follow user preference. While not directly enabling code execution or privilege escalation, this can bias routing behavior, reduce user control, and cause incorrect or over-broad activation for Chinese text fragments regardless of the user's desired interaction mode.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The wrapper enables download behavior by default whenever --search-only is not set, which can cause the skill to initiate torrent or other downloader activity without explicit confirmation at this layer. In the context of an anime-finder skill handling raw user utterances like '帮我下载' or mixed shorthand, this increases the chance of unintended downloads, network activity, disk writes, and legal/compliance issues if the query was ambiguous or misparsed.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The examples explicitly normalize requests that lead to downloading content, but they do not indicate any requirement for clear user confirmation or warnings before file-writing actions begin. In a skill designed to handle requests end-to-end, this increases the chance that ambiguous or shorthand prompts could trigger unintended downloads, filesystem changes, or retrieval of potentially infringing content without sufficiently explicit consent.

Missing User Warnings

High
Confidence
97% confidence
Finding
The workflow can automatically transition from intent parsing to downloading based on profile settings, confidence, and watch intent, without a clear user-facing confirmation step at the execution point. In this skill context, that means the agent may fetch copyrighted content and initiate torrent activity on the host from an ambiguous conversational request.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The code retrieves remote torrent data from the internet and writes it to a local file automatically as part of the queueing flow. Even though it uses a temporary directory, this is still a host-side file write and remote content fetch triggered by agent logic without an explicit disclosure or consent checkpoint.

Missing User Warnings

High
Confidence
96% confidence
Finding
This code path starts a background torrent daemon when one is not already running, which creates persistent system changes and network behavior without a dedicated confirmation barrier. In an agent environment, silently enabling a downloader is more dangerous than a normal CLI utility because the trigger can be conversational and indirect.

External Transmission

Medium
Category
Data Exfiltration
Content
Returns (results, api_ok). api_ok is False on network/API errors.
    Retries up to 2 times with 3s interval on timeout.
    """
    url = f"https://api.bgm.tv/search/subject/{urllib.parse.quote(query)}?type=2"
    max_retries = 2

    for attempt in range(max_retries + 1):
Confidence
91% confidence
Finding
The script transmits raw user queries to a third-party service (api.bgm.tv), which is an external data disclosure boundary. In this skill context, user requests may contain sensitive watch/download intents, mixed free-form text, or personal preferences, so sending them off-platform without explicit consent or minimization creates a real privacy risk even though HTTPS is used.

External Transmission

Medium
Category
Data Exfiltration
Content
def get_subject_info(subject_id: int) -> dict:
    """Get detailed subject info."""
    url = f"https://api.bgm.tv/subject/{subject_id}"
    try:
        req = urllib.request.Request(url, headers={
            "User-Agent": "Mozilla/5.0",
Confidence
82% confidence
Finding
This additional external request fetches subject details from the same third-party API, increasing dependency on and data exchange with an external service. While it does not directly send arbitrary user text in this call, it expands third-party interaction and metadata retrieval in a workflow that handles user-driven content, which still has privacy and availability implications.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- `confidence`: `high` / `medium` / `low`
- `confirmation_required`: whether the agent should stop and ask exactly one question
- `autonomy_mode`: `auto_execute` / `ask_once` / `halt`
- `profile_applied`: which fields came from the persisted user profile
- `reason_codes`: machine-readable reasons behind the decision
Confidence
86% confidence
Finding
The documented `autonomy_mode` includes `auto_execute`, which signals that the skill is designed to let an agent perform actions without an additional confirmation step. In the context of a download helper that searches external sources and can queue torrents, autonomous execution materially raises the risk of unintended downloads, network access, and persistence of potentially infringing or unsafe content.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
self.assertEqual(output["download"]["status"], "fallback_to_magnet")
        self.assertIn("Transmission 未安装", output["download"]["reason"])

    def test_natural_language_download_query_auto_executes_to_queue(self):
        verify_payload = fixture("verification_found_jojo_latest.json")
        search_payload = {
            "query": "STEEL BALL RUN JoJo's Bizarre Adventure",
Confidence
92% confidence
Finding
The test codifies behavior where a natural-language request automatically proceeds to queue a torrent download with confirmation_required set to false and autonomy_mode set to auto_execute. In this skill context, that is materially risky because the agent handles end-to-end media acquisition and downloading, so misclassification, prompt injection through user phrasing, or ambiguous title resolution could trigger unauthorized downloads or distribution of infringing/malicious content.

Static analysis

No suspicious patterns detected.