Background Remover Claw Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:37 AM UTC
• Version: 1.7.0

Overview

This is a third-party image API skill that does not look malicious, but it needs review because its scope is blurry and it handles the Neta API token unsafely.

Review before installing. Use this only if you are comfortable sending prompts and a Neta API token to api.talesofai.cn, prefer a limited or throwaway token, avoid putting secrets directly on the command line until the skill supports NETA_TOKEN properly, and install from a pinned trusted revision where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:9
• Finding: Unpinned Third-Party Installer and Mutable Skill Source## Vulnerability Details **File Location**: `README.md:9-12`; also documented in `SKILL.md:31-34` **Vulnerability Type**: Supply-chain risk caused by unpinned external installation sources **Risk Level**: Medium ### Vulnerable Code `README.md:9-12`: ```bash **Via npx skills:** ```bash npx skills add BarbaraLedbettergq/background-remover-claw-skill ``` ``` Equivalent installation guidance appears in `SKILL.md:31-34`: ```bash ## Install ```bash npx skills add BarbaraLedbettergq/background-remover-claw-skill ``` ``` ### Technical Analysis The documented installation command invokes an npm-resolved `skills` CLI without specifying a package version and retrieves a GitHub-hosted Skill without pinning a commit hash, immutable release, checksum, or cryptographic signature. Consequently, the code installed in the future is not guaranteed to match the code reviewed during this audit. This does not establish that the current installer or repository is malicious, but it creates a mutable supply-chain boundary through which compromised or unexpectedly changed content could be delivered. The issue is classified as an insecure dependency practice rather than remote payload execution in the audited runtime code: the examined JavaScript files do not download and execute remote source code themselves. ### Attack Path 1. An attacker compromises the npm package supplying the `skills` command, the referenced GitHub account/repository, or its release process. 2. The attacker publishes or replaces content with a malicious installer or Skill revision. 3. A user follows the documented unpinned `npx skills add` command. 4. The package manager resolves the current mutable package and repository content rather than the audited revision. 5. The malicious installation logic or Skill code executes with the privileges of the installing user. ### Impact Assessment Successful exploitation could permit arbitrary code executi ...[truncated 386 chars]
• Remediation: ## Remediation Suggestions 1. Pin the `skills` CLI to a reviewed, exact version rather than allowing `npx` to resolve the latest release. 2. Pin the Skill source to an immutable Git commit or signed release tag. 3. Publish and verify a checksum or cryptographic signature for the downloaded Skill artifact. 4. Use a trusted package registry identity and enable release protections such as multi-factor authentication and provenance attestations. 5. Prefer a locked installation manifest that records all resolved versions and integrity hashes. 6. Document how users can verify the source revision before installation.

T09 · Insecure Skill Coding Practices

Warning

• Location: backgroundremoverclaw.js:7
• Finding: API Token Passed Through Command-Line Arguments## Vulnerability Details **File Location**: `backgroundremoverclaw.js:7-14`; related handling in `bgremove.js:21-24` and usage guidance in `SKILL.md:15-18,23-26` and `README.md:35-38` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code `backgroundremoverclaw.js:7-14`: ```javascript const positional = []; let size = "square"; let token = null; let refUuid = null; for (let i = 0; i < args.length; i++) { if (args[i] === "--size" && args[i + 1]) { size = args[++i]; } else if (args[i] === "--token" && args[i + 1]) { token = args[++i]; } ``` `bgremove.js:21-24` uses the same pattern: ```javascript // Parse --token early (before HEADERS are built) const _argv = process.argv.slice(2); const _tidx = _argv.indexOf('--token'); const _token = _tidx >= 0 ? _argv[_tidx + 1] : null; ``` The documented invocation in `SKILL.md:15-18` explicitly places the secret on the command line: ```bash export NETA_TOKEN=your_token_here node <script> "your prompt" --token "$NETA_TOKEN" ``` ### Technical Analysis Both executable scripts obtain the API token from `process.argv`. Command-line secrets can be recorded in shell history and, depending on the operating system and process isolation settings, may be observable through process-listing utilities or process metadata while the program runs. Although `package.json` declares a required `NETA_TOKEN` environment variable and the README claims that the script resolves it, neither implementation reads `process.env.NETA_TOKEN`. Expanding the environment variable into `--token "$NETA_TOKEN"` still places the resulting secret in the child process's argument vector. The token is subsequently transmitted through the fixed HTTPS API header `x-token` to `api.talesofai.cn`. That network transmission is necessary for the declared remote API functionality and no s ...[truncated 1173 chars]
• Remediation: ## Remediation Suggestions 1. Read the token from `process.env.NETA_TOKEN` and make that the preferred authentication mechanism. 2. Support protected standard-input or operating-system credential-store retrieval for environments where environment variables are unsuitable. 3. Deprecate the `--token` option or display a warning explaining that command-line secrets may be exposed. 4. Update the README and `SKILL.md` so examples do not pass tokens in command-line arguments. 5. Ensure error messages and diagnostic output never include request headers or token values. 6. Recommend short-lived, narrowly scoped tokens and provide clear token-rotation and revocation instructions. 7. Add automated tests confirming that `NETA_TOKEN` is read directly and that credentials are not emitted to standard output or standard error.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose and documentation say this skill performs Neta-based background removal, but the analyzed behavior indicates it actually uses a different service, performs broader image generation/editing, and supports undeclared features. This kind of capability mismatch is dangerous because it can mislead users about where prompts and tokens are sent, what operations occur, and what data may be exposed to an untrusted third party.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is ներկայացված as a background remover, but the request body uses a general image-generation endpoint with arbitrary free-text prompting and a generic jobType. This creates a significant capability mismatch: users may believe they are performing bounded editing on an image when the skill can instead generate arbitrary content via a third-party API.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The README instructs users to install and run the skill via `npx skills` without pinning a specific version or immutable source. This creates a supply-chain risk because users may fetch whatever package/version is current at execution time, including a compromised or typosquatted update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README explicitly tells users to pass an API token on the command line (`--token YOUR_NETA_TOKEN`) without warning that command-line arguments may be exposed through shell history, process listings, logs, or monitoring tools. In a skill intended for image generation, this is unnecessary risk because the same token can be supplied more safely via environment variables.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises Bash usage and references external API access, but it does not declare any tool scope, permissions, or allowed-tools constraints. That omission weakens reviewability and enforcement, making it easier for a skill to perform network actions or evolve into broader behavior than users expect.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: Using 'npx skills add' without pinning an exact version introduces supply-chain risk because the installed package may change over time or resolve to a compromised release. A user installing later could receive different code than what was originally reviewed.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The CLI accepts arbitrary positional text and turns it into a free-text prompt, which is broader than necessary for a background-removal tool. In this skill context, that overbroad capability increases the risk of deceptive behavior, policy bypass, and unexpected third-party content generation beyond user expectations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill sends the user-supplied token in the x-token header to an external service, but provides no meaningful disclosure beyond requiring the CLI flag. Users may not understand which third party receives the credential or the associated trust boundary, creating avoidable secret-handling risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The user's prompt content is transmitted to a third-party API without an explicit warning that their text will leave the local environment. If prompts contain sensitive, proprietary, or personal information, this can lead to unintended data disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

// --- Submit job ---
async function makeImage() {
  const res = await fetch("https://api.talesofai.cn/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

• Confidence: 84% confidence
• Finding: This code performs external network transmission to a third-party API, sending request metadata, authentication token, and prompt-derived content off-host. In isolation, external calls are not always unsafe, but in this skill they are security-relevant because the transmission is central to the behavior and insufficiently disclosed to users.

External Transmission

Medium

• Category: Data Exfiltration

Content

// --- Submit job ---
async function makeImage() {
  const res = await fetch("https://api.talesofai.cn/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

• Confidence: 84% confidence
• Finding: This code performs external network transmission to a third-party API, sending request metadata, authentication token, and prompt-derived content off-host. In isolation, external calls are not always unsafe, but in this skill they are security-relevant because the transmission is central to the behavior and insufficiently disclosed to users.

External Transmission

Medium

• Category: Data Exfiltration

Content

for (let attempt = 0; attempt < maxAttempts; attempt++) {
    await new Promise((r) => setTimeout(r, 2000));

    const pollRes = await fetch(`https://api.talesofai.cn/v1/artifact/task/${taskUuid}`, { headers });
    if (!pollRes.ok) {
      console.error(`Poll error (${pollRes.status}): ${await pollRes.text()}`);
      process.exit(1);

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script requires the API token to be passed as a command-line argument, which exposes the credential to shell history, process listings, audit logs, and possibly other local users or monitoring systems. Although the token must be sent to the remote API to function, accepting it via argv without safer alternatives or warnings materially increases the chance of credential leakage.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata says it performs background removal, but the code also supports full image generation from arbitrary prompts via the `gen-remove` command before removing the background. This capability mismatch can mislead users and higher-level agents into invoking broader functionality than expected, which is a security and trust boundary issue because hidden or under-disclosed behavior may trigger unintended content generation, API usage, or policy violations.

Static analysis

No suspicious patterns detected.