mangasnap-oneclick-userscript
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to install a browser userscript from an external repository:
https://morethanpaper.github.io/MangaSnap-OneClick/. This source is not managed by the skill author or a verified service.\n- [DYNAMIC_EXECUTION]: The documentation provides several JavaScript snippets intended for manual execution in the browser console or within a userscript manager to customize script behavior.\n - Evidence: Multiple configuration blocks for
window.__LUMINA_CONFIG__and metadata handling logic.\n- [COMMAND_EXECUTION]: The 'Batch Processing' section contains logic that automates browser navigation to multiple URLs via thewindow.location.hrefproperty.\n- [INDIRECT_PROMPT_INJECTION]: The skill interacts with and processes untrusted data from third-party websites, presenting an attack surface for indirect injection.\n - Ingestion points: DOM selectors for images and titles on external manga hosting platforms.\n
- Boundary markers: There are no delimiters or explicit instructions to ignore potentially malicious embedded content in site data.\n
- Capability inventory: Creation and download of file archives and automated browser navigation.\n
- Sanitization: No sanitization or validation of data extracted from external websites is described before its use in file naming or metadata.
Audit Metadata