Skillv1.0.0

ClawScan security

Mascot Generator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 17, 2026, 7:38 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This skill's code and instructions are consistent with its stated purpose: it calls the Neta / TalesOfAI image API to generate mascot images and only requires a user-provided API token passed at runtime.
Guidance: This skill appears coherent and limited to calling the TalesOfAI/Neta image API. Before installing or running it: (1) verify you trust the API provider (api.talesofai.com / neta.art) and review their privacy/terms; (2) do not include sensitive or secret data in prompts (they will be sent to the remote API); (3) protect your API token (pass it at runtime, avoid sharing or checking it into repos); and (4) if uncertain, run the script locally in an isolated environment to review network traffic and behavior yourself.

Purpose & Capability: okName/description match the implementation: the JS script posts prompts to api.talesofai.com to request images. No unrelated services, binaries, or credentials are requested.
Instruction Scope: okSKILL.md and the script only instruct the agent/user to provide a text prompt (and optional reference UUID) and a Neta API token; runtime behavior is limited to POSTing the prompt and polling the provider for a result URL. The code does not read local files, environment variables, or other system state.
Install Mechanism: okNo install spec is included and the skill is instruction-plus-a-small script. No external downloads or archive extraction occur as part of an install step.
Credentials: okNo saved environment variables or other credentials are declared; the only credential used is a user-supplied Neta token passed via the --token flag, which is appropriate for this API client.
Persistence & Privilege: okThe skill is not always-enabled, does not request persistent system privileges, and does not modify other skills or global agent settings.