mangasnap-oneclick-userscript

Warn

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill directs users to install a browser userscript from an external repository: https://morethanpaper.github.io/MangaSnap-OneClick/. This source is not managed by the skill author or a verified service.\n- [DYNAMIC_EXECUTION]: The documentation provides several JavaScript snippets intended for manual execution in the browser console or within a userscript manager to customize script behavior.\n
  • Evidence: Multiple configuration blocks for window.__LUMINA_CONFIG__ and metadata handling logic.\n- [COMMAND_EXECUTION]: The 'Batch Processing' section contains logic that automates browser navigation to multiple URLs via the window.location.href property.\n- [INDIRECT_PROMPT_INJECTION]: The skill interacts with and processes untrusted data from third-party websites, presenting an attack surface for indirect injection.\n
  • Ingestion points: DOM selectors for images and titles on external manga hosting platforms.\n
  • Boundary markers: There are no delimiters or explicit instructions to ignore potentially malicious embedded content in site data.\n
  • Capability inventory: Creation and download of file archives and automated browser navigation.\n
  • Sanitization: No sanitization or validation of data extracted from external websites is described before its use in file naming or metadata.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 8, 2026, 11:45 PM