Floating Product Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a real product-image generator, but it asks users to pass an API token on the command line and does not consistently disclose the exact external service endpoint in the loaded skill instructions.

Review before installing. Use a low-privilege, revocable Neta token, avoid putting sensitive product plans or personal data in prompts, and prefer a safer token workflow if one becomes available. Treat the npx install command as mutable unless you install through a trusted pinned or reviewed channel.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: floatingproductgenerator.js:17

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: floatingproductgenerator.js, lines 13-24 and 139-145; documented in SKILL.md, lines 14-22, and README.md, lines 60-67
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

javascript

function parseArgs(argv) {
  const args = { _: [] };
  for (let i = 0; i < argv.length; i++) {
    const a = argv[i];
    if (a === '--size') args.size = argv[++i];
    else if (a === '--token') args.token = argv[++i];
    else if (a === '--ref') args.ref = argv[++i];
    else if (a === '--help' || a === '-h') args.help = true;
    else args._.push(a);
  }
  return args;
}

javascript

const tokenFlag = args.token;
const TOKEN = tokenFlag;

if (!TOKEN) {
  console.error('\n✗ Token required. Pass via: --token YOUR_TOKEN');
  console.error('  Get yours at: https://www.neta.art/open/');
  process.exit(1);
}

The documented invocation reinforces this handling:

bash

node floatingproductgenerator.js "your prompt" --token YOUR_TOKEN

Technical Analysis

The Skill requires users to supply the Neta API token as a command-line argument. Command-line arguments can be recorded in shell history and may be observable through local process-inspection interfaces, system monitoring agents, audit logs, crash diagnostics, or process telemetry.

The program subsequently sends the token in the x-token HTTP header to https://api.talesofai.com. Sending the credential to this service is necessary for the declared image-generation functionality and is protected by HTTPS. The vulnerability is therefore not the intended API transmission itself, but the unnecessary exposure caused by accepting and documenting the token directly on the command line.

No token logging, unrelated credential collection, or transmission to additional domains was found.

Attack Path

1. A user foll ...[truncated 1223 chars]

Remediation

View remediation

Remediation Suggestions

1. Make a protected environment variable, such as NETA_TOKEN, the primary credential input:

   javascript

   const TOKEN = process.env.NETA_TOKEN;
   

2. Alternatively, accept the token through standard input or an interactive hidden prompt so it does not appear in process arguments.
3. Remove commands containing literal token placeholders from the primary usage path. Document a safer workflow:

   bash

   export NETA_TOKEN='...'
   node floatingproductgenerator.js "your prompt"
   

4. If --token must remain for compatibility, clearly warn that it may expose the credential through shell history and process listings.
5. Ensure errors never include request headers or token values.
6. Encourage users to assign the minimum available API permissions, rotate exposed tokens, and configure usage limits where the provider supports them.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-34; duplicated in README.md, lines 8-14
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

markdown

## Install
```bash
npx skills add blammectrappora/floating-product-generator

text

The README also documents:

```bash
npx skills add blammectrappora/floating-product-generator

Technical Analysis

The installation instructions invoke npx skills without pinning the skills package to an audited version or integrity value. If the package is not already installed locally, npx may resolve and execute a mutable package release from the configured npm registry.

This introduces executable third-party code outside the reviewed project. A compromised package publisher, registry account, dependency chain, or malicious future release could cause installation-time code execution under the invoking user's privileges.

The audited project's own package.json contains no dependencies or lifecycle scripts. No evidence was found that the current skills package or this project is malicious. The risk arises from recommending execution of an unpinned external package whose contents can change after this audit.

Attack Path

1. A user follows the documented installation command.
2. npx resolves the unversioned skills package through the user's configured package registry.
3. An attacker compromises the package, its publisher account, its dependency chain, or the registry resolution path and publishes a malicious version.
4. The user's invocation retrieves and executes that changed package.
5. Malicious code runs with the permissions of the user who launched the installation command.

This path depends on compromise or malicious modification of the external package supply chain; the audited repository itself contains no demonstrated installation payload.

Impact Assessment

A ...[truncated 489 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to a specifically reviewed version:

   bash

   npx --yes skills@<reviewed-version> add blammectrappora/floating-product-generator
   

2. Document the expected package publisher, registry, version, and integrity checksum.
3. Prefer a trusted, already-installed Skill manager rather than automatically downloading executable tooling.
4. Provide a manual installation method that allows users to inspect the repository before executing any code.
5. Periodically review the pinned installer and its transitive dependencies before updating the documented version.
6. Warn users not to run installation commands with administrator or root privileges unless strictly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description says the skill uses the Neta AI API, but the detected behavior indicates requests to a different service endpoint and additional undisclosed handling of reference-image identifiers. This mismatch is dangerous because users may provide tokens or inputs under false assumptions about where data is sent, undermining informed consent and increasing the risk of credential or data exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly instructs users to send prompts and an API token to a third-party image-generation service, but it does not clearly warn that user content and credentials are transmitted off-platform or advise users against submitting sensitive data. In a skill intended for commercial product imagery, users may reasonably include unreleased product details, proprietary marketing content, or other business-sensitive information, making undisclosed third-party transmission a meaningful privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares Bash usage and requires an API token, but it does not declare any tool scope or allowed network permissions despite making external requests. This weakens user and platform visibility into what the skill can access, increasing the chance of unintended data egress or unsafe execution under overly broad defaults.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Line L20 says to use the skill when someone asks to 'generate or create floating product photography generator images,' which is awkwardly phrased and does not clearly delimit what requests should or should not invoke the skill. The file also lacks negative examples or tighter constraints, increasing the chance of unintended activation for general image-generation requests.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

Using npx skills add blammectrappora/floating-product-generator without a pinned version can install different code over time, including compromised or malicious updates. This creates a supply-chain risk because consumers cannot reliably reproduce or audit the exact package version being installed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The top-level description claims the tool uses Neta AI, but the runtime code posts to a different host. Misleading provenance around a networked skill materially increases risk because users may provide prompts, reference IDs, and API credentials under false assumptions about the receiving party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Accepting the API token on the command line exposes it to shell history, process listings, CI logs, and telemetry tools on multi-user or managed systems. In this skill, that risk is amplified because the token is then transmitted to an unexpectedly different service endpoint, compounding credential handling concerns.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill advertises Neta AI but actually sends prompts and the supplied API token to talesofai.com. This kind of service/endpoint mismatch is dangerous because it defeats informed consent, can mislead users about where their data and credentials are going, and may indicate impersonation or unauthorized use of another service's branding.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This code transmits the user's prompt, dimensions, optional reference UUID, and x-token credential to an external service. External transmission is expected for an image-generation skill, but here it is security-relevant because the destination host differs from the advertised provider, creating a data exfiltration and trust-boundary issue.

Content

Scanner excerpt · floatingproductgenerator.js (reported line 69)May include surrounding context.

js

};
  }

  const res = await fetch(`https://api.talesofai.com/v3/make_image`, {
    method: 'POST',
    headers: {
      'x-token': token,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The polling request sends the API token and task UUID to an external service to retrieve the generated image. Polling itself is normal for asynchronous APIs, but because it continues communicating with the same undisclosed host, it extends the exposure window for credentials and metadata beyond a single request.

Content

Scanner excerpt · floatingproductgenerator.js (reported line 102)May include surrounding context.

js

async function pollTask({ token, taskUuid }) {
  const maxAttempts = 90;
  for (let attempt = 0; attempt < maxAttempts; attempt++) {
    const res = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
      headers: {
        'x-token': token,
        'x-platform': 'nieta-app/web',

Static analysis

No suspicious patterns detected.