ClawHub
Back to skill

Security audit

Wallpaper Claw Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward external-API wallpaper generator, with some install and token-handling cautions but no evidence of hidden persistence, local data harvesting, or deceptive execution.

Install only from a source/version you trust, avoid putting sensitive prompts into the generator, and treat the Neta/talesofai token like a password. Prefer a safer token mechanism if the publisher adds one, and rotate the token if you have already pasted it into shell history or logs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned Remote Installation Creates Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
`. 2. Pin the Skill source to an immutable release tag or commit hash rather than a mutable repository reference. 3. Publish and verify cryptographic checksums or signatures for released Skill artifacts. 4. Use installation modes that disable package lifecycle scripts where supported. 5. Document the exact reviewed installer version and Skill revision. 6. Periodically audit the pinned installer and update it through a controlled review process. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
wallpaper.js:25
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis
"your prompt" --token YOUR_TOKEN ``` ### Technical Analysis The only supported token-resolution mechanism places the API credential in `process.argv`. Command-line secrets can be recorded in shell history, terminal logs, process-monitoring systems, crash diagnostics, or automation logs. Depending on operating-system process visibility and local security policy, command-line arguments may also be observable by other local processes while the script is running. The scripts do not print the token themselves. They transmit it in the `x-token` header over HTTPS exclusively to the declared `https://api.talesofai.com` service, which is necessary for the advertised image-generation functionality. The security issue is therefore the local command-line handling of the credential, not the authenticated network request itself. ### Attack Path 1. A user follows the documentation and supplies a valid Neta API token through `--token`. 2. The complete command is retained in shell history, captured in an execution log, or exposed through local process inspection. 3. An attacker with access to that history, logging system, or process metadata extracts the token. 4. The attacker sends authenticated requests to the Neta ...[truncated 620 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This second mismatch independently confirms that the implementation uses Tales of AI endpoints instead of the declared Neta service and exposes a --ref image inheritance/editing capability that is not properly disclosed. In this context, undisclosed editing/inheritance features and service substitution increase the risk of covert data transfer, unexpected content processing, and misuse of user-supplied identifiers or prior images.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This second mismatch independently confirms that the implementation uses Tales of AI endpoints instead of the declared Neta service and exposes a --ref image inheritance/editing capability that is not properly disclosed. In this context, undisclosed editing/inheritance features and service substitution increase the risk of covert data transfer, unexpected content processing, and misuse of user-supplied identifiers or prior images.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly states the skill is powered by a third-party API but does not clearly warn users that their prompts, and potentially reference-image identifiers, are transmitted to that external service. This creates a meaningful privacy and data-handling risk because users may submit sensitive text or identifiers without understanding that the content leaves the local environment and is processed by an outside provider.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares only a Bash tool and omits an explicit tool scope or permissions model even though its documented behavior requires outbound network access to an external API. This creates a transparency and policy-enforcement gap: users and hosting platforms may not realize the skill can transmit prompts and tokens off-platform, increasing the risk of unauthorized data egress and secret exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The install instruction uses an unpinned npx skills add reference, which allows consumers to fetch whatever version is current at installation time. This weakens supply-chain integrity because a later malicious or compromised update could be installed without review, leading to execution of unexpected code or changed behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata claims it uses the Neta AI image generation API, but the code actually sends the user token and prompts to a different service endpoint at api.talesofai.com. This is a trust-boundary violation and deceptive integration behavior: users may provide credentials or sensitive prompts under false assumptions about which provider receives them.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

This request transmits user-supplied prompt content and an API token to an external service. In the context of an agent skill, external transmission is security-relevant because prompts may contain sensitive data and the token grants access to the remote account or service.

Content

Scanner excerpt · wallpaperclaw.js (reported line 62)May include surrounding context.

js
}

// --- Submit job ---
const makeRes = await fetch("https://api.talesofai.com/v3/make_image", {
  method: "POST",
  headers,
  body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

This request transmits user-supplied prompt content and an API token to an external service. In the context of an agent skill, external transmission is security-relevant because prompts may contain sensitive data and the token grants access to the remote account or service.

Content

Scanner excerpt · wallpaperclaw.js (reported line 62)May include surrounding context.

js
}

// --- Submit job ---
const makeRes = await fetch("https://api.talesofai.com/v3/make_image", {
  method: "POST",
  headers,
  body: JSON.stringify(body),

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill sends the user's prompt and authentication token to a third-party API, but provides no user-facing notice at runtime that their input and credential are being transmitted off-host. In an agent-skill context, this can lead to unintentional disclosure of sensitive prompts or misuse of a user token if the operator assumes the skill is local-only.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
75% confidence
Finding

The polling request sends the authentication token to the same third-party API repeatedly. While it does not newly transmit the user prompt, it extends external credential exposure and dependency on the remote service, which matters in a skill context where users may not expect repeated outbound calls.

Content

Scanner excerpt · wallpaperclaw.js (reported line 90)May include surrounding context.

js
await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));

  const pollRes = await fetch(
    `https://api.talesofai.com/v1/artifact/task/${taskUuid}`,
    { headers }
  );

Vague Triggers

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger guidance says to use the skill when someone asks to "generate or create ai wallpaper generator images," which is fairly broad and does not define boundaries or exclusions. It lacks negative examples or clearer scope about when this skill should be chosen versus other generic image-generation tools.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The stated purpose is generating AI wallpaper images, but the code also searches a remote character catalog using /v2/travel/parent-search to resolve character identifiers before generation. While related to prompt enrichment, this is additional remote behavior not conveyed by the manifest's plain image-generation description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The inline comment Done — extract URL implies any non-PENDING/non-MODERATION state means the task is complete and a URL should be extracted. In practice, the code treats every other status as done and errors if no URL is present, which may contradict the comment if the API can return other terminal or failure statuses without an image URL.

Content

No source excerpt is available for this finding.