← 返回 Skills 市场

MAL Anime Tracker

Name: MAL Anime Tracker
Author: josetseph

作者 josetseph · GitHub ↗ · v1.9.3 · MIT-0

cross-platform ✓ 安全检测通过

141

总下载

当前安装

版本数

在 OpenClaw 中安装

/install mal-anime-tracker

功能描述

Track and manage your MyAnimeList anime lists, get anime details, rankings, seasonal updates, and receive new episode notifications.

使用说明 (SKILL.md)

mal-anime-tracker Skill

Purpose

Track anime/manga lists on MyAnimeList (MAL) and receive automatic notifications via OpenClaw when new episodes are available.

Setup

Set the following environment variables (e.g., in your shell configuration or openclaw vault):

ACCESS_TOKEN=your_access_token
REFRESH_TOKEN=your_refresh_token
CLIENT_ID=your_client_id
CLIENT_SECRET=your_client_secret

Install dependencies:
```
pip install -r requirements.txt
```

Authorization

Register your application on the MyAnimeList Developer Portal.
Generate a code_challenge (12-char alphanumeric) and navigate to the MAL OAuth2 authorization URL to get your code.
Run the authorization command:
```
python3 auth.py authorize \x3CCLIENT_ID> \x3CCLIENT_SECRET> \x3Ccode> \x3Ccode_challenge>
```
This will output your tokens, which you should add to your environment.

Features

Monitor progress for anime you are currently watching.
Query current anime/manga lists.
Automatic token refresh.
Search and manage personal MAL data.

CLI Reference

python3 api.py search \x3Cquery> - Search for anime.
python3 api.py update \x3Canime_id> \x3Cstatus> - Update anime status (e.g., watching, completed).
python3 api.py delete \x3Canime_id> - Remove anime from list.
python3 api.py list-anime - Show your anime list.
python3 api.py check-updates - Check for new episodes and output updates.
python3 api.py refresh-auth - Force a token refresh using your credentials.
python3 api.py list-manga - Show your reading list.
python3 api.py search-forums \x3Cquery> - Search MAL forums.

Automation

# Refresh token and check updates every 6 hours
0 */6 * * * python3 /path/to/skills/mal-anime-tracker/api.py refresh-auth && python3 /path/to/skills/mal-anime-tracker/api.py check-updates | xargs -I {} openclaw message send --target \x3CCHAT_ID> --message "{}"

安全使用建议

This package appears to do what it says: it calls the MyAnimeList API and sends notifications via OpenClaw. If you install it, keep these points in mind: - You must provide MAL OAuth credentials (CLIENT_ID, CLIENT_SECRET, ACCESS_TOKEN, REFRESH_TOKEN). Store them in a secrets vault (OpenClaw vault) rather than plaintext .env when possible. - auth.py prints tokens to stdout for you to capture — avoid running it where shell history or logs are retained, or copy printed tokens into a secure vault immediately. - The cron/example sends messages using the openclaw CLI; ensure that the CLI and any chat target IDs are properly controlled (don't send tokens or other secrets in messages). - Review or run the code in an isolated environment before giving it access to production secrets. The codebase has some duplicate logic and modest quality issues, but no indicators of exfiltration to unexpected endpoints. - Optional: verify the manifest/version consistency and review logs for accidental token leakage after first run.

功能分析

Type: OpenClaw Skill Name: mal-anime-tracker Version: 1.9.3 The mal-anime-tracker skill is a standard integration for the MyAnimeList (MAL) API, allowing users to track anime/manga progress and receive notifications. The code in api.py and auth.py uses the requests library to interact exclusively with the official MAL API endpoints (api.myanimelist.net). While there are minor functional bugs (e.g., auth.py lacks a CLI entry point and api.py is missing the refresh-auth command mentioned in the documentation), there is no evidence of malicious intent, data exfiltration to unauthorized domains, or prompt injection attacks. The environment variables requested (ACCESS_TOKEN, CLIENT_ID, etc.) are necessary for the stated OAuth2 functionality.

能力标签

requires-oauth-token

能力评估

✓ Purpose & Capability

Name/description (MAL tracking, notifications) align with required credentials (CLIENT_ID, CLIENT_SECRET, ACCESS_TOKEN, REFRESH_TOKEN), network access to api.myanimelist.net, and notify.message capability declared in manifest. There are no unrelated external services or unexpected credentials requested.

ℹ Instruction Scope

Runtime instructions focus on MAL OAuth setup, installing Python deps, and running the provided CLI commands. One minor concern: auth.py prints ACCESS_TOKEN/REFRESH_TOKEN to stdout (SKILL.md instructs capturing these), which can leak tokens into shells/logs if not handled carefully; the cron example pipes output into an openclaw message send command (expected for notification feature).

✓ Install Mechanism

No download/install of arbitrary code; dependencies are standard Python packages (requests, python-dotenv) listed in requirements.txt. The skill is instruction+code and relies on pip installing two well-known libraries.

✓ Credentials

Requested environment variables are limited to MAL OAuth credentials and tokens, which are required for the described functionality. No unrelated secrets, cloud credentials, or system tokens are requested.

✓ Persistence & Privilege

always is false and the skill does not request system-wide configuration changes. It can be invoked autonomously (default), which is expected for a notifier skill and is not excessive here.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install mal-anime-tracker
安装完成后，直接呼叫该 Skill 的名称或使用 /mal-anime-tracker 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.9.3

Finalized manifest/code mapping to resolve metadata scanner mismatches.

v1.9.2

Final comprehensive review and synchronization of all components, documentation, and dependencies.

v1.9.1

Fixed critical code mismatches, improved API error handling, and aligned manifest metadata.

v1.9.0

Security hardening: Removed file-system secret persistence (auth now streams tokens to stdout), aligned manifest with requirements, and consolidated auth flow.

v1.8.11

Fixed manifest.json to include full environment requirement definitions.

v1.8.10

Final sync: restored all CLI references and updated automation instructions in SKILL.md.

v1.8.9

Added missing manifest.json to published package to align registry metadata with credential requirements.

v1.8.8

Security update: Removed local .env reliance in favor of environment variables to prevent unsafe secret storage.

v1.8.7

Replaced Node package.json with Python-aware manifest.json to correctly handle Python dependencies and metadata.

v1.8.6

Updated package.json to declare all .env requirements and properly scope capabilities to resolve metadata inconsistencies.

v1.8.5

Added runtime security check for .env file permissions.

v1.8.4

Updated documentation to emphasize security best practices (local .env storage/permissions) and clarified the usage of the messaging tool to address security scanner concerns.

v1.8.3

Added package.json with capability declarations to address registry metadata inconsistencies.

v1.8.2

Finalized documentation, auth flow synchronization, and automation clarity.

v1.8.1

Consolidated and restored all comprehensive CLI and feature documentation.

v1.8.0

Full auth flow implementation: auth.py now handles token generation, .env setup is automated.

v1.7.1

Fixed syncing issue, restored comprehensive CLI and feature documentation.

v1.7.0

Added auth.py for automated token refresh, fully integrated credential usage, and updated automation instructions.

v1.6.1

Clarified auth process in documentation, emphasizing secure token storage and the OAuth flow process.

v1.6.0

Security update: Simplified auth (single ACCESS_TOKEN), removed sensitive credential prompts from documentation, and cleaned up code structure to address security flagging.

元数据

Slug mal-anime-tracker

版本 1.9.3

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 28

常见问题