Logo Design Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:32 AM UTC
• Version: 1.0.0

Overview

The skill appears to generate logos as advertised, but its token handling and unpinned install command create avoidable security risks users should review.

Install only if you are comfortable sending logo prompts and reference IDs to the Neta/TalesOfAI API. Prefer a pinned or ClawHub-managed install path, avoid running npx installers with elevated privileges, and avoid putting real API tokens directly in shell commands unless you understand the local exposure risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: logodesigngenerator.js:3

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

"your prompt" --token YOUR_TOKEN ``` ### Technical Analysis The application requires the Neta API token to be supplied directly through the `--token` command-line argument. Command-line arguments are not an appropriate transport for secrets because they can be exposed through: - Shell history files. - Process-listing and system-monitoring interfaces. - Terminal session logs. - CI/CD job logs and command tracing. - Wrapper scripts or orchestration systems that record executed commands. The token is subsequently sent to the expected HTTPS API as the `x-token` request header. No evidence indicates that the application intentionally transmits it to an unrelated destination. The vulnerability is specifically the local exposure created by accepting and documenting the token as a command-line argument. ### Attack Path 1. A user follows the documented command and supplies a valid token using `--token`. 2. The complete command is retained in shell history, captured by automation logs, or temporarily exposed through process inspection. 3. Another local user, compromised process, log reader, or CI/CD operator obtains the token. 4. The a ...[truncated 613 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Remote Installation Through npx

Content

View full analysis

Remediation

View remediation

add ... ``` 2. Pin the skill itself to an immutable release, content digest, or full commit hash rather than relying solely on a mutable repository identifier. 3. Publish and verify cryptographic checksums or signed release artifacts before installation. 4. Use lockfiles where applicable and commit them to source control. 5. Document the expected package publisher, repository URL, version, and integrity value so users can verify provenance. 6. Prefer a trusted internal registry or allowlisted mirror for automated and high-privilege environments. 7. Avoid running remote package installers with administrator or root privileges. 8. Add automated dependency and provenance monitoring for unexpected publisher, ownership, checksum, or release changes. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx skills add blammectrappora/logo-design-generator without pinning a specific package version. This can cause users to fetch and execute whatever version is current at install time, which increases supply-chain risk if the package is later compromised, replaced, or updated with malicious code. In this context, the risk is meaningful because the command is presented as the primary installation path for end users.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares tools: Bash and instructs use of a tokenized external API, but it does not define any explicit tool scope or allowed-tools boundaries despite requiring network access. This creates an authorization ambiguity where an agent may invoke broader shell/network behavior than intended, increasing the risk of unintended external requests or misuse of sensitive tokens.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation guidance says to use the skill whenever someone asks to generate or create AI logo generator images, which is broad and underspecified. Overly permissive triggering can cause the agent to invoke this skill in cases where a safer or more appropriate non-executing response would suffice, unnecessarily exposing tokens or causing external API calls.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The install instruction uses npx skills add blammectrappora/logo-design-generator without pinning a specific version. This introduces supply-chain risk because a future compromised or malicious package version could be fetched and executed automatically at install time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script requires the API token via a --token command-line argument, which can expose the secret through shell history, process listings, CI logs, and terminal recording. In a CLI skill context this is a real credential-handling weakness because users are explicitly instructed to pass a live token on the command line with no safer alternative or warning.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This request sends user-supplied prompt content and the authentication token to an external third-party API. That is expected for an image-generation skill, but it is still a real data-exposure boundary because sensitive prompts, references, and credentials leave the local environment and are processed by a remote service.

Content

Scanner excerpt · logodesigngenerator.js (reported line 75)May include surrounding context.

js

async function main() {
  console.error(`\n● Generating logo (${size} ${dimensions.width}×${dimensions.height})…`);

  const createRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This request sends user-supplied prompt content and the authentication token to an external third-party API. That is expected for an image-generation skill, but it is still a real data-exposure boundary because sensitive prompts, references, and credentials leave the local environment and are processed by a remote service.

Content

Scanner excerpt · logodesigngenerator.js (reported line 75)May include surrounding context.

js

async function main() {
  console.error(`\n● Generating logo (${size} ${dimensions.width}×${dimensions.height})…`);

  const createRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The polling request continues transmitting the API token to the external service and reveals task identifiers to the remote endpoint. This is expected behavior for checking job status, so the context makes it less suspicious, but it still represents ongoing third-party data transmission and dependency on external handling of identifiers and credentials.

Content

Scanner excerpt · logodesigngenerator.js (reported line 102)May include surrounding context.

js

for (let attempt = 0; attempt < 90; attempt++) {
    await new Promise((r) => setTimeout(r, 2000));

    const pollRes = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
      headers,
    });

Static analysis

No suspicious patterns detected.