Impressionist Art Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

The skill appears to generate images as advertised, but it handles API tokens unsafely and documents a mutable install command that users should review before installing.

Review this skill before installing. Prefer the ClawHub install path or a pinned, verified package source, and do not paste a real API token directly into commands that may be saved in shell history or logs. If you use it, treat prompts, reference IDs, and the token as data sent to the external image-generation service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: impressionistartgenerator.js:15

Finding

API Token Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: impressionistartgenerator.js:15-23, 37-47; documented usage in SKILL.md:15-19, 25 and README.md:23, 31, 37, 43, 49, 66-76
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

javascript

function parseArgs(argv) {
  const args = { positional: [], size: 'landscape', token: null, ref: null };
  for (let i = 0; i < argv.length; i++) {
    const a = argv[i];
    if (a === '--size') { args.size = argv[++i]; }
    else if (a === '--token') { args.token = argv[++i]; }
    else if (a === '--ref') { args.ref = argv[++i]; }
    else if (a.startsWith('--size=')) { args.size = a.slice(7); }
    else if (a.startsWith('--token=')) { args.token = a.slice(8); }
    else if (a.startsWith('--ref=')) { args.ref = a.slice(6); }
    else { args.positional.push(a); }
  }
  return args;
}

javascript

const tokenFlag = args.token;
const TOKEN = tokenFlag;

if (!TOKEN) {
  console.error('\n✗ Token required. Pass via: --token YOUR_TOKEN');
  console.error('  Get yours at: https://www.neta.art/open/');
  process.exit(1);
}

The documented invocation reinforces this insecure credential-delivery method:

bash

node impressionistartgenerator.js "your prompt" --token YOUR_TOKEN

Technical Analysis

The API credential is accepted exclusively through the --token command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they can be retained in shell history, captured by process-monitoring and diagnostic systems, included in CI/CD logs, or exposed through process metadata to other principals depending on operating-system configuration.

The token is legitimately transmitted to the image-generation service as an x-token header, but the vulnerability occurs before transmission: the credential is exposed in the local command invocatio ...[truncated 1314 chars]

Remediation

View remediation

Remediation Suggestions

1. Add support for a protected environment variable such as NETA_TOKEN:

   javascript

   const TOKEN = process.env.NETA_TOKEN || args.token;
   

2. Prefer the environment variable over the command-line flag and deprecate --token.
3. For interactive execution, optionally accept the token through hidden stdin input so it is not echoed or retained in shell history.
4. Update all examples to use a protected environment variable:

   bash

   NETA_TOKEN="..." node impressionistartgenerator.js "your prompt"
   

   Where supported, users should load the variable from a restricted secret manager rather than entering it directly in the command line.
5. Add explicit documentation warning that literal command-line credentials can leak through process listings, history, and logs.
6. Ensure errors, debug output, telemetry, and exception handlers never serialize request headers or token values.
7. Recommend immediate token rotation when accidental command-line or log exposure occurs.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:32-34; duplicated in README.md:11-15
Vulnerability Type: Mutable third-party package execution without version pinning or integrity verification
Risk Level: Medium

Vulnerable Code

bash

npx skills add blammectrappora/impressionist-art-generator

Technical Analysis

The installation instructions invoke npx skills without specifying an audited package version or integrity value. If the package is unavailable locally, npx can retrieve and execute the package currently resolved from the configured npm registry. Consequently, the code executed during installation is not fixed to the version reviewed with this project and can change independently of the audited files.

This creates a supply-chain trust boundary involving the package registry, the skills package publisher, package maintainers, and the user's npm registry configuration. A compromised publisher account, malicious future release, ownership transfer, registry compromise, or manipulated registry configuration could cause different code to execute under a command that appears identical to the documented command.

The audited project itself contains no dependency declarations or embedded malicious installation code. The weakness is specifically the documented execution of a mutable external package.

Attack Path

1. An attacker compromises the skills package publisher, gains control following an ownership transfer, compromises the configured registry, or otherwise causes a malicious release to resolve under the package name.
2. The attacker publishes a version containing malicious installation or runtime behavior.
3. A victim follows the documented unpinned npx skills add ... command.
4. npx resolves and downloads the attacker-controlled current version.
5. The downloaded package executes with the privileges of the invoking user.
6. The malicious package can access data and perf ...[truncated 632 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin skills to a specifically reviewed version:

   bash

   npx --yes skills@AUDITED_VERSION add blammectrappora/impressionist-art-generator
   

2. Document the expected package publisher, registry, package version, and release provenance.
3. Use lockfiles and package-manager integrity metadata where installation occurs within a managed project.
4. Prefer a trusted, locally installed CLI whose version is managed separately rather than downloading executable code during every invocation.
5. Verify package signatures, checksums, or registry provenance attestations when the ecosystem supports them.
6. Apply the same hardened installation command consistently in both SKILL.md and README.md.
7. In sensitive environments, inspect the resolved package and its lifecycle scripts before execution and run installation with the minimum necessary privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior does not match the observed behavior: it claims to use the Neta API but static analysis indicates communication with different endpoints and broader capabilities, including forwarding a reference identifier for inheritance/edit-like behavior. This is dangerous because users may disclose prompts, tokens, or reference material under false assumptions about where data goes and what operations the skill performs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx skills add blammectrappora/impressionist-art-generator without pinning a specific version. This allows whatever package/version is current at execution time to be fetched and run, increasing supply-chain risk if the package is updated maliciously or a compromised release is published. Because this is an installation command in a skill README, users are likely to copy-paste it directly, making the risk practical.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README repeatedly tells users to pass the API token via --token on the command line, and even states this is the only supported method. Command-line secrets can be exposed through shell history, terminal logging, process listings, CI logs, and support screenshots, which can lead to credential theft and unauthorized API use. In this context the danger is elevated because the documentation normalizes insecure secret handling and gives no warning or safer alternative.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises only the Bash tool and does not declare an explicit tool scope or permissions boundary, while its documented behavior requires outbound network access to an external API. This creates a transparency and policy-enforcement gap: a host may allow the skill under incomplete assumptions, and users are not clearly informed that prompts and tokens will be sent off-platform.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

Using npx skills add blammectrappora/impressionist-art-generator without a pinned version makes installation non-reproducible and exposes users to supply-chain risk if the upstream package changes, is compromised, or is republished with malicious content. A later install could fetch materially different code than what was reviewed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · impressionistartgenerator.js (reported line 74)May include surrounding context.

js

console.error(`→ Submitting task (${size.width}×${size.height})...`);

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · impressionistartgenerator.js (reported line 74)May include surrounding context.

js

console.error(`→ Submitting task (${size.width}×${size.height})...`);

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · impressionistartgenerator.js (reported line 105)May include surrounding context.

js

console.error(`→ Submitting task (${size.width}×${size.height})...`);

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),