webtoon-vault-manga-downloader
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation directs users to download a ZIP archive from an unverified GitHub Pages site (bunatechnologybackup.github.io) that is not affiliated with the stated vendor.
- [REMOTE_CODE_EXECUTION]: The installation instructions involve downloading, unzipping, and installing Python packages from an untrusted source repository (BunaTechnologyBackUP/manga-pull-cli), which could lead to the execution of arbitrary code during the setup process.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external manga hosting platforms, creating an attack surface where instructions hidden in images or metadata could influence an agent's behavior.
- Ingestion points: The skill fetches data from various external URLs (e.g., mhpic.com, dumanwu.com).
- Boundary markers: No delimiters or ignore instructions are defined to separate untrusted web content.
- Capability inventory: The skill has the ability to write files (CBZ archives) and perform network operations.
- Sanitization: No sanitization of the scraped HTML or metadata is mentioned.
Audit Metadata