ClawHub
Back to skill

Security audit

Children Book Illustration Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it asks users to pass an API token on the command line and documents an unpinned install command, so it should be reviewed before installation.

Install only if you are comfortable sending prompts and reference IDs to the Neta/TalesOfAI API. Avoid putting real tokens directly on the command line in shared machines, CI logs, or shell history, and prefer a pinned or reviewed install source where possible. Do not submit private manuscripts, personal data, secrets, or regulated content unless the provider's terms and retention policy are acceptable to you.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:9
Finding

Unpinned Package Execution in the Documented Installation Process

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
childrenbookillustrationgenerator.js:10
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis
"your prompt" --token YOUR_TOKEN ``` ### Technical Analysis The program accepts the Neta API token exclusively through the `--token` command-line argument. Command-line secrets can be exposed through several local channels: - Shell history when a literal token is entered interactively. - Process inspection facilities while the program is running. - Process-monitoring or endpoint-management software. - CI/CD logs, debugging traces, shell tracing, or wrapper scripts that record command arguments. - Job schedulers and automation platforms that retain submitted command lines. The token is legitimately transmitted as the `x-token` HTTPS header to the declared API host. The issue is not the outbound API request itself, but the credential's prior exposure through the local process argument vector and documented command usage. Using `--token "$NETA_TOKEN"` avoids writing the expanded value literally into some shell-history configurations, but the expanded token can ...[truncated 1408 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to install and run tooling via npx skills without pinning a specific version. This can cause users to execute whatever package version is current at install time, increasing supply-chain risk if the package is compromised or a breaking/malicious release is published. In a skill-distribution context, this is more dangerous because the README directly encourages copy-paste execution from a package registry.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares Bash usage and instructs users to invoke a script that requires an API token and clearly interacts with an external service, but it does not declare any tool scope or network permissions. This creates a transparency and governance gap: the agent may perform networked actions without explicit permission boundaries, making review and least-privilege enforcement harder.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description and usage text do not clearly warn users that their prompts and any reference-image inputs may be sent to an external image-generation API. This is a real privacy and data-handling issue because users may submit copyrighted, personal, or sensitive creative material without informed consent about third-party processing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation condition, 'Use when someone asks to generate or create children book illustration ai generator images,' is broad and ambiguous, which can cause the skill to trigger in situations the user did not clearly intend. Overbroad activation increases the chance of unnecessary external API use, token exposure in execution flow, or unintended transmission of user content to a third party.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The install command uses npx skills add blammectrappora/children-book-illustration-generator without a pinned version, so consumers may fetch whatever package version is current at install time. If the upstream package is changed, compromised, or typosquatted, users could install malicious code or altered skill behavior without notice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The hardcoded external endpoint at api.talesofai.com confirms that content is transmitted to a remote service outside the local trust boundary. In this skill's context, that behavior is core functionality rather than obviously malicious, but it still creates privacy, compliance, and token-handling risk if users are unaware or if sensitive prompts are submitted.

Content

Scanner excerpt · childrenbookillustrationgenerator.js (reported line 76)May include surrounding context.

js
async function main() {
  console.error(`Generating children's book illustration (${size} ${chosen.width}x${chosen.height})...`);

  const createRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The hardcoded external endpoint at api.talesofai.com confirms that content is transmitted to a remote service outside the local trust boundary. In this skill's context, that behavior is core functionality rather than obviously malicious, but it still creates privacy, compliance, and token-handling risk if users are unaware or if sensitive prompts are submitted.

Content

Scanner excerpt · childrenbookillustrationgenerator.js (reported line 76)May include surrounding context.

js
async function main() {
  console.error(`Generating children's book illustration (${size} ${chosen.width}x${chosen.height})...`);

  const createRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · childrenbookillustrationgenerator.js (reported line 103)May include surrounding context.

js
for (let attempt = 0; attempt < 90; attempt++) {
    await new Promise((r) => setTimeout(r, 2000));

    const pollRes = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
      headers,
    });

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README describes sending user prompts and optional reference identifiers to an external image-generation API but does not clearly warn users that their inputs will be transmitted to a third-party service. This creates a privacy and data-handling risk because users may include sensitive story content, personal data, or proprietary reference assets without realizing they leave the local environment. The skill context increases relevance because creative prompts and reference IDs may correspond to unpublished manuscripts or private materials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.