ClawHub
Back to skill

Security audit

Fantasy Map Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to generate fantasy maps as advertised, but it asks users to install through an unpinned npx command and pass an API token on the command line.

Review before installing. Use this only for prompts you are comfortable sending to the Neta/Tales of AI API, avoid secrets or confidential creative material in prompts, and prefer a low-scope or disposable token. Be cautious with the unpinned npx install command and the --token flag because both can increase exposure if the upstream package changes or command arguments are logged.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party CLI Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:32-34 and README.md:12-15
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Relevant code snippets:

SKILL.md:32-34

markdown
## Install
```bash
npx skills add blammectrappora/fantasy-map-generator
text

`README.md:12-15`

```markdown
**Via npx skills:**
```bash
npx skills add blammectrappora/fantasy-map-generator
text

### Technical Analysis

The documented installation command invokes the `skills` npm package through `npx` without specifying an exact package version or integrity constraint. When a package is not already installed locally, `npx` can download and execute the version currently resolved by the npm registry. The skill source is also identified by a mutable repository reference rather than an immutable commit or content hash.

Consequently, the code executed by a future installation may differ from the code covered by this audit. Compromise of the npm publisher account, registry package, upstream repository, or associated release process could turn the documented installation command into a code-execution vector.

No malicious dependency is present in the audited artifact, and `package.json` declares no runtime dependencies. The risk arises specifically from the mutable installation process documented for users.

### Attack Path

1. An attacker compromises the npm package, its publisher account, or the referenced upstream skill repository.
2. The attacker publishes a modified CLI release or replaces mutable upstream skill content with a malicious payload.
3. A user follows the documented `npx skills add blammectrappora/fantasy-map-generator` command.
4. `npx` resolves and executes the currently available, attacker-controlled CLI package.
5. The malicious installer or retrieved skill runs with the invoking user's operating-system permissions.

### Impact Assessm
...[truncated 505 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the skills CLI to a reviewed exact version, for example by using npx --yes skills@<exact-version> ....
  • Pin the skill source to an immutable commit, release artifact, or content digest rather than a mutable repository reference.
  • Publish and verify cryptographic checksums or signatures for installation artifacts.
  • Prefer a lockfile-backed installation process with npm integrity metadata when practical.
  • Document the expected publisher, version, commit, and checksum so users can verify provenance before execution.
  • In CI environments, use a pre-reviewed artifact from a trusted internal registry or cache and execute it with minimal permissions.

T09 · Insecure Skill Coding Practices

Warning
Location
fantasymapgenerator.js:10
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: fantasymapgenerator.js:10-11,28; documented at SKILL.md:13-19 and README.md:23-29
Vulnerability Type: Sensitive token exposure through process arguments and shell history
Risk Level: Medium

Relevant code snippets:

fantasymapgenerator.js:10-11

javascript
} else if (args[i] === "--token" && args[i + 1]) {
  tokenFlag = args[++i];

fantasymapgenerator.js:28

javascript
const TOKEN = tokenFlag;

SKILL.md:13-19

markdown
Requires a Neta API token (free trial at <https://www.neta.art/open/>). Pass it via the `--token` flag.

```bash
node <script> "your prompt" --token YOUR_TOKEN
text

`README.md:23-29`

```markdown
This skill requires a Neta API token (free trial available at <https://www.neta.art/open/>).

Pass it via the `--token` flag:

```bash
node <script> "your prompt" --token YOUR_TOKEN
text

### Technical Analysis

The implementation requires the Neta API token to be supplied as a command-line argument and reads it directly from `process.argv`. Command-line arguments are not an appropriate secret transport mechanism because they may be retained in shell history, captured in terminal or CI logs, exposed through process-monitoring utilities, or collected by endpoint telemetry.

On systems where process arguments are visible to other local users or monitoring agents, an observer may recover the token while the script is running. Even after execution, the literal command can remain in shell history or build logs. Quoting the token or storing it first in a shell variable does not necessarily prevent its expanded value from appearing in the child process argument list.

The reviewed code sends the token through the `x-token` header only to the declared HTTPS endpoint, `api.talesofai.com`; it does not print the token or transmit it to unrelated hosts. The weakness is therefore in 
...[truncated 1085 chars]
Remediation
View remediation

Remediation Suggestions

  • Read the token from a protected environment variable such as NETA_TOKEN instead of requiring it as a command-line argument.
  • Support secret input through standard input or a hidden interactive prompt for local use.
  • Integrate with the deployment environment's secret manager for CI and production workflows.
  • If backward compatibility requires --token, deprecate it, emit a security warning, and give environment-variable input precedence.
  • Update all examples so they do not place literal credentials in command lines.
  • Ensure CI systems mask the token and do not echo commands containing secret values.
  • Keep the token only in memory for the duration of the request, never print it, and document immediate rotation if disclosure is suspected.
  • Apply short token lifetimes, least-privilege scopes, usage monitoring, and revocation controls on the API side.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README encourages users to submit free-form worldbuilding prompts to an external image generation API but does not clearly warn that prompt contents are transmitted to a third party. Users may unknowingly send sensitive campaign notes, unpublished creative work, proprietary game concepts, or personal data to an external service, creating privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The README instructs users to install and run the skill via npx skills without pinning a specific version. This creates a supply-chain risk because users may fetch and execute whatever package/version is current at install time, including a compromised or typosquatted update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation guidance says to use the skill when someone asks to "generate or create fantasy map generator images," which is ambiguous and does not clearly define the exact user intents or trigger phrases. It also lacks negative examples or boundaries, increasing the risk of unintended invocation for generic image-generation requests.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The install instruction uses npx skills add blammectrappora/fantasy-map-generator without pinning a specific version, so users may fetch whatever package or remote content is current at execution time. This creates a supply-chain risk: if the upstream package, tag, or dependency chain is compromised or changes unexpectedly, users could install or run unreviewed code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill sends both the user-supplied prompt and the authentication token to a third-party API endpoint, but provides no explicit notice that user content and credentials are being transmitted off-host. This is a real privacy/security issue because users may unknowingly submit sensitive campaign notes, proprietary worldbuilding content, or secrets in prompts, and the token is also exposed to the remote service by design.

Content

No source excerpt is available for this finding.