ClawHub
Back to skill

Security audit

Ai Headshot Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward AI headshot generator, but users should understand it sends prompts, optional reference IDs, and an API token to the Neta/TalesOfAI service.

Before installing, verify the publisher and consider installing from a pinned commit or trusted ClawHub package rather than a floating npx reference. Use a low-privilege, revocable Neta/TalesOfAI token and avoid putting sensitive personal details or unauthorized reference images in prompts. Rotate the token if it may have been exposed through shell history or process logs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Unpinned Remote Installer and Mutable Skill Reference

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29-32; README.md:12-16
Vulnerability Type: Supply-chain risk caused by unpinned remote dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:29-32:

markdown
## Install
```bash
npx skills add blammectrappora/ai-headshot-skill
text

`README.md:12-16`:

```markdown
**Via npx skills:**
```bash
npx skills add blammectrappora/ai-headshot-skill
text

### Technical Analysis

The documented installation command invokes the `skills` npm package through `npx` without pinning its version. It also identifies the remotely retrieved skill through a mutable owner-and-project reference rather than an immutable commit, signed release, or verified artifact digest.

Consequently, the code executed or installed when a user follows the instructions is not necessarily identical to the content covered by this audit. A later release, compromised publisher account, compromised source repository, or malicious replacement in the dependency distribution path could alter either the installer or the installed skill.

The reviewed project does not itself retrieve and execute a runtime payload. The risk arises specifically from the documented installation process and its reliance on mutable, unverified remote components.

### Attack Path

1. An attacker compromises the npm package used by `npx`, the remote skill publisher account, or the associated source repository.
2. The attacker publishes a malicious version of the installer or modifies the mutable skill reference.
3. A user follows the documented `npx skills add blammectrappora/ai-headshot-skill` command.
4. `npx` retrieves the current remote package rather than a version verified during this audit.
5. The malicious installer or skill executes with the privileges of the invoking user or installs attacker-controlled files into the user's skill environment.

### Impact Assessment

Successful exploi
...[truncated 447 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the skills CLI to an explicitly reviewed version, for example by using an exact package version rather than allowing npx to resolve the current release.
  • Pin the installed skill to an immutable commit hash or a versioned, signed release.
  • Publish and verify a cryptographic checksum or signature for the expected skill artifact before installation.
  • Use a lockfile or equivalent integrity metadata wherever the installation ecosystem supports it.
  • Run installation with the minimum required privileges and avoid invoking the installer as an administrator or root user.
  • Document how users can inspect the downloaded files and verify their provenance before enabling the skill.

T09 · Insecure Skill Coding Practices

Warning
Location
aiheadshot.js:10
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: aiheadshot.js:10-12; SKILL.md:10-16; README.md:58-64
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

aiheadshot.js:10-12:

javascript
} else if (args[i] === "--token" && args[i + 1]) {
  token = args[++i];
} else if (args[i] === "--ref" && args[i + 1]) {

SKILL.md:10-16:

markdown
## Token

Requires a Neta API token (free trial at <https://www.neta.art/open/>). Pass it via the `--token` flag.

```bash
node <script> "your prompt" --token YOUR_TOKEN
text

`README.md:58-64`:

```markdown
This skill requires a Neta API token (free trial available at <https://www.neta.art/open/>).

Pass it via the `--token` flag:

```bash
node <script> "your prompt" --token YOUR_TOKEN
text

### Technical Analysis

The program accepts the API token directly from `process.argv`, and the documentation presents this as the required token-delivery mechanism. Command-line arguments are not an appropriate secret transport mechanism because they may be retained in shell history, captured by terminal or command telemetry, included in diagnostic records, or exposed through process-inspection facilities while the command is running.

The token is intentionally transmitted over HTTPS to the documented API in the `x-token` request header. That expected API use is not itself the finding. The weakness is that the credential is exposed locally before transmission by placing it directly in the command line.

Exploitability through process inspection depends on operating-system permissions and process-isolation settings. Shell history and command logging can preserve the token beyond the lifetime of the process, increasing the exposure window.

### Attack Path

1. A user follows the documentation and invokes the script with `--token YOUR
...[truncated 954 chars]
Remediation
View remediation

Remediation Suggestions

  • Support a protected environment variable, such as NETA_API_TOKEN, as the primary token source.
  • Prefer reading the token from standard input without terminal echo or from an operating-system credential store for interactive use.
  • Retain --token only if compatibility requires it, emit a warning when it is used, and clearly document its local exposure risks.
  • Update all usage examples so they do not place real credentials directly in command lines.
  • Avoid logging the token, request headers, complete process arguments, or environment values.
  • Encourage users who previously supplied tokens through the command line to clear relevant shell history and rotate credentials if command records may have been exposed.
  • Ensure tokens are narrowly scoped, short-lived where supported, subject to usage limits, and easy to revoke.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documentation presents the skill as a Neta AI headshot generator, but the finding indicates behavior that differs materially from that description, including use of a different external service, tokenized CLI execution, and reference-based image inheritance. Description-behavior mismatch is dangerous because it prevents informed consent, can misroute secrets to unexpected third parties, and may conceal capabilities not anticipated by users or orchestrators.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README promotes sending user prompts and optional reference-image identifiers to an external image-generation API but does not clearly warn users that their data is transmitted to a third party. In a headshot-generation context, prompts and reference identifiers may relate to personal images or identity-linked content, creating privacy, consent, and data-handling risk if users are unaware of external sharing.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares only the Bash tool and does not scope or disclose its network behavior, even though it sends prompts and tokens to an external image-generation API. Missing tool/permission scoping increases the chance that an agent or user invokes the skill without understanding that external network access and secret transmission are required.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation guidance is broad enough to trigger on generic requests to create headshot images, without clarifying prerequisites, exclusions, or user-consent requirements for sending data to an external API. Broad triggers can cause the skill to activate unexpectedly, increasing the likelihood of unnecessary network calls, secret usage, or submission of sensitive user prompts/images to a third party.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

Using npx skills without a pinned version can cause installation of whatever package version is current at execution time, creating a supply-chain risk. A malicious or compromised upstream release could change behavior, introduce credential theft, or execute unintended code during install or runtime.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This request sends externally supplied prompt content and the x-token credential to a remote server. External transmission is expected for an image-generation skill, but it is still security-relevant because it exports user data and secrets off-host to a third party.

Content

Scanner excerpt · aiheadshot.js (reported line 72)May include surrounding context.

js
// --- POST to generate image ---
async function generateImage() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This request sends externally supplied prompt content and the x-token credential to a remote server. External transmission is expected for an image-generation skill, but it is still security-relevant because it exports user data and secrets off-host to a third party.

Content

Scanner excerpt · aiheadshot.js (reported line 72)May include surrounding context.

js
// --- POST to generate image ---
async function generateImage() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata claims it uses the Neta AI API, but the implementation sends requests to talesofai.com instead. This discrepancy undermines informed consent and trust boundaries because users may provide prompts and tokens assuming they are interacting with one vendor while data is actually sent to another service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code transmits the user prompt and an authentication token to a third-party API without any user-facing disclosure at runtime. In a skill context, prompts may contain sensitive personal data and the token is a secret, so silent transmission increases the risk of unintended data exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · aiheadshot.js (reported line 105)May include surrounding context.

js
await new Promise((r) => setTimeout(r, delayMs));

    const res = await fetch(
      `https://api.talesofai.com/v1/artifact/task/${taskUuid}`,
      { headers: HEADERS }
    );

Static analysis

No suspicious patterns detected.