ClawHub
Back to skill

Security audit

Impressionist Art Generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward image-generation wrapper that sends the user's prompt and Neta token to the Neta/TalesOfAI API when run.

Install only if you trust the Neta/TalesOfAI service and this publisher with your prompts, token, and any reference image UUIDs. Prefer a scoped or trial token where available, avoid putting long-lived secrets directly in shared shell history, and review the provider's terms for generated art usage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill declares only Bash tooling while static analysis indicates network-capable behavior, yet no corresponding permission disclosure is present. This is dangerous because users and hosting agents may invoke the skill without understanding it will transmit prompts and credentials to an external service, reducing informed consent and weakening policy enforcement.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill claims to use the Neta AI API, but analysis indicates it actually communicates with api.talesofai.com and supports a reference-inheritance feature not fully disclosed in the description. Endpoint misrepresentation is high risk because it can cause users to send API tokens and creative inputs to an unexpected third party, and the hidden ref behavior may expose or reuse prior asset metadata in ways users did not intend.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs users to pass an API token but does not clearly warn that the token will be transmitted to an external image-generation service. This is dangerous because users may expose secrets without understanding where they are going, especially given the separate mismatch finding suggesting the true destination may differ from the advertised provider.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.