anakin

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Anakin web-scraping and research skill, but it requires trusting the external Anakin CLI/API key workflow and the web content it retrieves.

Before installing, make sure you trust Anakin and the `anakin-cli` package, store the API key securely, and review any changes to `.gitignore` or shell startup files. Treat scraped and research outputs as untrusted web-derived data until you verify them.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent can fetch and process web pages through Anakin and save results locally.

Why it was flagged

The skill intentionally gives the agent CLI-driven network scraping and research capabilities. This matches the skill purpose, but users should ensure URLs and research topics are appropriate.

Skill content

Supports single URL scraping, batch scraping, AI-powered search, and autonomous deep research.

Recommendation

Use the skill for user-approved URLs or topics, and review generated files before relying on or sharing them.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone who can access the chat, shell history, or shell profile file might be able to see or reuse the API key.

Why it was flagged

The skill requires an Anakin API key and gives instructions that may place the key in command history or a shell startup file. This is expected for the integration but sensitive.

Skill content

Ask for their API key, then run:

```bash
anakin login --api-key "ak-their-key-here"
```

... echo 'export ANAKIN_API_KEY="ak-your-key-here"' >> ~/.zshrc

Recommendation

Prefer a secret manager or protected environment variable, avoid pasting keys in shared contexts, and rotate the key if it is exposed.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may install or update external code from PyPI.

Why it was flagged

The skill depends on an external PyPI package without a pinned version. That dependency is disclosed and central to the skill, but its provenance matters.

Skill content

"install": {
    "pip": {
      "package": "anakin-cli",
      "bins": ["anakin"]
    }
  }

Recommendation

Install only if you trust Anakin and the `anakin-cli` package; consider pinning a known-good version in controlled environments.

Low

#ASI06: Memory and Context Poisoning

What this means

Research outputs may include inaccurate, biased, or instruction-like content from websites.

Why it was flagged

The skill retrieves and summarizes arbitrary web content, which can be unreliable or contain prompt-like text. This is expected for a web research skill but should be treated as untrusted context.

Skill content

Autonomously searches for relevant sources
- Scrapes and analyzes multiple pages
- Synthesizes information across sources

Recommendation

Verify citations and do not treat scraped page text as trusted instructions for the agent.