ClawHub
Back to skill

Security audit

Selfie Art Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill performs its stated image-generation function, but it handles the required API token insecurely and uses mutable installation instructions that users should review before installing.

Install only from a pinned, trusted version and treat the Neta token as sensitive. Prefer changing the script to read NETA_TOKEN directly from the environment before use, and avoid submitting sensitive personal descriptions or reference identifiers unless you accept that they will be sent to the external image-generation service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Installation Commands Create a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
selfieartgenerator.js:17
Finding

API Token Is Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented behavior does not match the actual implementation: it reportedly contacts a different external service than declared, accepts undisclosed reference inheritance, and ignores a user-facing style option. This undermines informed consent and security review, because user prompts or reference identifiers may be sent to an unexpected third party and users cannot reliably predict how their data is handled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README tells users to send prompts and a Neta API token to a third-party image generation service but does not warn that prompt contents, metadata, or credentials may be exposed to an external provider. In a selfie-art context, prompts may include sensitive personal descriptions or image references, so the missing privacy and data-handling disclosure increases the risk of unintentional data sharing.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx skills add yangzhou-chaofan/selfie-art-generator without pinning an exact package or artifact version. This creates a supply-chain risk because users may fetch whatever version is current at execution time, including a later compromised or malicious release.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares Bash tooling and describes calling an external API, but it does not explicitly constrain tool permissions or allowed network access. That creates an avoidable trust gap: an installer or agent may grant broader execution/network capability than users expect, increasing the chance of unintended outbound requests or abuse if the implementation changes or is malicious.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

Installing via an unpinned 'npx skills add' reference makes the supply chain mutable: future changes to the referenced package or resolver behavior could cause users to fetch different code than expected. This is dangerous because a later compromised or malicious version could be installed transparently under the same command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script requires the API token to be provided on the command line via --token, which exposes the secret to shell history, process listings, and potentially other local users or monitoring tools. In an agent/automation context, this is more dangerous because orchestration logs and telemetry may also capture the full command line, increasing the chance of credential leakage.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · selfieartgenerator.js (reported line 75)May include surrounding context.

js
}

async function makeImage() {
  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · selfieartgenerator.js (reported line 75)May include surrounding context.

js
}

async function makeImage() {
  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · selfieartgenerator.js (reported line 105)May include surrounding context.

js
}

async function makeImage() {
  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

Static analysis

No suspicious patterns detected.