Cosplay Reference Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:16 AM UTC
• Version: 1.0.1

Overview

The skill looks like a real cosplay image-generation helper, but it merits Review because it uses an unpinned remote installer and asks users to pass an API token on the command line.

Review this before installing. Prefer ClawHub’s reviewed install path or a pinned version/commit instead of the unpinned npx command, and avoid putting a real API token directly in shell commands. Treat prompts and reference UUIDs as data sent to the external Neta/TalesOfAI service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Remote Installer Introduces Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-34; README.md:8-11
Vulnerability Type: Unpinned third-party installer execution
Risk Level: Medium

Vulnerable Code

SKILL.md:31-34:

markdown

## Install
```bash
npx skills add blammectrappora/cosplay-reference-generator

text

`README.md:8-11`:

```markdown
## Install

```bash
npx skills add blammectrappora/cosplay-reference-generator

text

### Technical Analysis

The documented installation procedure invokes the `skills` npm package through `npx` without specifying an exact package version or integrity hash. It also identifies the Skill through a mutable publisher namespace without pinning a reviewed revision.

Consequently, the code executed by this command is not necessarily the same code that was reviewed during this audit. Package updates, publisher-account compromise, package takeover, or changes to the remote Skill repository could alter the effective installation payload.

No evidence indicates that the currently reviewed project contains a malicious dependency or installer. The vulnerability is the unsafe trust model created by directing users to execute mutable, remotely resolved installation components.

### Attack Path

1. An attacker compromises the npm package, its publisher account, the remote Skill publisher account, or another relevant distribution component.
2. The attacker publishes a modified version containing malicious installer behavior or replaces the remotely distributed Skill content.
3. A user follows the documented `npx skills add blammectrappora/cosplay-reference-generator` command.
4. `npx` resolves and executes the currently available installer rather than a version and artifact fixed at audit time.
5. The malicious installer runs with the permissions of the invoking user and can perform any operation available to that account.

### Impact Assessment

Successful exploitation could provide at
...[truncated 461 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to an exact reviewed version rather than allowing npx to resolve the latest release.
• Pin the installed Skill to an immutable commit, release identifier, or content digest.
• Publish and verify cryptographic integrity information for installation artifacts.
• Use a lockfile or an equivalent reproducible installation mechanism where supported.
• Document the expected publisher identity and verification procedure.
• Avoid installer workflows that execute newly downloaded code without presenting or verifying the resolved version first.
• Re-audit the installer and Skill artifact whenever either pinned version changes.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:13

Finding

API Token Is Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-18, README.md:54-64, cosplayreferencegenerator.js:20-27, cosplayreferencegenerator.js:37-45
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Low

Vulnerable Code

SKILL.md:13-18:

markdown

## Token

Requires a Neta API token (free trial at https://www.neta.art/open/). Pass it via the `--token` flag.

```bash
node cosplayreferencegenerator.js "your prompt" --token YOUR_TOKEN

text

`cosplayreferencegenerator.js:20-27`:

```javascript
} else if (a === '--token') {
  args.token = argv[++i];
} else if (a === '--ref') {
  args.ref = argv[++i];
} else if (a.startsWith('--size=')) {
  args.size = a.slice('--size='.length);
} else if (a.startsWith('--token=')) {
  args.token = a.slice('--token='.length);

cosplayreferencegenerator.js:37-45:

javascript

async function main() {
  const args = parseArgs(process.argv.slice(2));
  const tokenFlag = args.token;
  const TOKEN = tokenFlag;

  if (!TOKEN) {
    console.error('\n✗ Token required. Pass via: --token YOUR_TOKEN');
    console.error('  Get yours at: https://www.neta.art/open/');
    process.exit(1);
  }

Technical Analysis

The Skill requires the Neta API token to be supplied directly as a command-line argument. Command-line secrets may be recorded in shell history, terminal-session logs, process accounting, diagnostic reports, automation logs, or process listings available to other local principals, depending on the operating system and environment.

Although the implementation does not print the token, parsing it from process.argv means the secret is already present in the process invocation metadata before the script begins executing. Supporting both --token VALUE and --token=VALUE does not mitigate this exposure.

The token is subsequently sent over HTTPS to the documented `ap ...[truncated 1228 chars]

Remediation

View remediation

Remediation Suggestions

• Accept the token from a dedicated environment variable, such as NETA_API_TOKEN, instead of requiring a command-line flag.
• Prefer secure interactive input from standard input with terminal echo disabled when an environment variable is unavailable.
• Integrate with an operating-system credential store or secret manager for persistent use.
• Remove examples that place real secrets directly on the command line.
• If backward compatibility requires retaining --token, mark it as deprecated and display a warning explaining the process-list and shell-history exposure.
• Ensure CI systems inject the token through masked secret variables and do not echo commands containing credentials.
• Document token revocation and rotation procedures for users who may already have exposed tokens through command history.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The manifest says the skill uses the Neta AI API, but the analyzed behavior indicates it actually talks to a different backend (api.talesofai.com) and supports reference-based inheritance/editing that is not transparently disclosed. This is dangerous because users may provide API tokens, copyrighted character references, or personal images under false assumptions about where data is sent and how it is processed, materially increasing privacy, consent, and data-handling risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to install and run the skill via npx skills without pinning a specific package version. This can cause users to fetch and execute whatever version is current at install time, increasing supply-chain risk if the upstream package or dependency chain is compromised or unexpectedly changed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares only tools: Bash and does not constrain network-capable behavior with an explicit permission or allowed-tools scope, even though the described workflow requires outbound API access. This creates an unnecessary trust gap: a caller or reviewer cannot tell from the manifest what external communication is permitted, making it easier for the skill implementation to exfiltrate prompts, tokens, or generated content to arbitrary endpoints.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

Using npx skills add blammectrappora/cosplay-reference-generator without a pinned version makes installation non-reproducible and exposes users to supply-chain risk if the package, tag, or transitive resolution changes later. An attacker who compromises the upstream package or publish path could cause future installs to pull unexpected code without any change to this skill file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires the API token to be passed on the command line via --token, which exposes the credential to shell history, process listings, and logging systems on multi-user or monitored environments. The token is then sent to the external service, so compromise of the local CLI argument leaks a live credential that can be reused against the third-party API.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · cosplayreferencegenerator.js (reported line 79)May include surrounding context.

js

};
  }

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · cosplayreferencegenerator.js (reported line 79)May include surrounding context.

js

};
  }

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · cosplayreferencegenerator.js (reported line 108)May include surrounding context.

js

};
  }

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

Static analysis

No suspicious patterns detected.