T09 · Insecure Skill Coding Practices
Warning
- Location
mangapanelgenerator.js:19- Finding
API Token Exposure Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Manga Panel Generator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward manga image generator that uses a disclosed third-party API, with manageable privacy, token-handling, and install-supply-chain cautions.
Install only if you are comfortable sending prompts and reference IDs to Neta/Tales of AI. Avoid putting long-lived API tokens directly on the command line when possible, rotate any token you may have exposed in shell history, and prefer a pinned or trusted install source.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:31- Finding
Unpinned Remote Installer and Mutable Skill Source
- Content
View full analysis
- Remediation
View remediation
add ... ``` 2. Pin the Skill to an immutable release, commit hash, or content digest when supported by the installation mechanism. 3. Publish checksums or signed provenance for released artifacts and verify them during installation. 4. Use an explicitly trusted package registry and document the expected publisher identity. 5. Enable multi-factor authentication and restricted publishing credentials for installer and Skill publisher accounts. 6. Re-audit new versions before updating pinned references, especially if installer scripts, dependencies, requested tools, or network destinations change. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The README instructs users to run
npx skills add ...without pinning a specific package version, which means installation behavior can change over time and could pull a compromised or maliciously updated package. In a skill-installation context, this is more dangerous than a generic docs issue because users are being told to execute a remote package manager command directly on their system.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README recommends passing the API token on the command line, which can expose the secret through shell history, process listings, logging, and terminal recording tools. This is particularly relevant for an API-backed image-generation skill because the token grants access to a third-party service and may enable unauthorized usage or quota/billing abuse if disclosed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises use of a token-authenticated external API and therefore has network capability, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege boundaries and makes it harder for reviewers and users to understand or constrain what the skill is permitted to access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description explains that a Neta API token is required, but it does not clearly warn that user prompts and token-authenticated requests will be transmitted to an external image-generation provider. This can mislead users about data handling and creates privacy and credential-use risk, especially when prompts may contain sensitive creative or personal content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation guidance 'Use when someone asks to generate or create manga panel generator images' is broad enough to trigger in many ordinary image-generation contexts. Overbroad routing can cause unintended invocation of this skill, increasing the chance that user prompts and API tokens are sent to the external service without sufficiently specific user intent.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 86% confidence
- Finding
The install instruction uses an unpinned 'npx skills' invocation, which can pull the latest resolver or package behavior at execution time. This creates supply-chain risk because users may install or run changed code without review if the upstream package or dependency set is altered.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This code performs an outbound POST request to a third-party domain and includes user-controlled content plus an authentication token. External transmission is expected for an image-generation skill, but it still represents a real data egress boundary: prompts, reference IDs, and credentials are sent off-box to an external operator.
- Content
js body.inherit_params = { collection_uuid: ref, picture_uuid: ref }; } const res = await fetch("https://api.talesofai.com/v3/make_image", { method: "POST", headers: { "x-token": token,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This code performs an outbound POST request to a third-party domain and includes user-controlled content plus an authentication token. External transmission is expected for an image-generation skill, but it still represents a real data egress boundary: prompts, reference IDs, and credentials are sent off-box to an external operator.
- Content
js body.inherit_params = { collection_uuid: ref, picture_uuid: ref }; } const res = await fetch("https://api.talesofai.com/v3/make_image", { method: "POST", headers: { "x-token": token,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill sends the user-provided prompt and optional reference identifier to a third-party API, but the script gives no explicit disclosure at runtime that this data leaves the local environment. In a skill context, users may reasonably assume prompts or reference IDs are processed locally; if those values contain sensitive story content, personal data, or internal asset identifiers, this creates an avoidable privacy and data-handling risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
The polling request makes repeated authenticated GET requests to the third-party API to retrieve task status and eventually an image URL. This is consistent with the skill's purpose and sends less user content than the initial POST, but it still leaks task identifiers and uses the same credential against an external service without explicit disclosure.
- Content
js for (let attempt = 0; attempt < maxAttempts; attempt++) { await new Promise((r) => setTimeout(r, 2000)); const res = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, { method: "GET", headers: { "x-token": token,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script requires an authentication token and transmits it to a remote service, but does not clearly disclose credential handling or safer usage patterns. While sending an API token to the service it authenticates to is expected, undisclosed credential use in an agent skill can mislead users and increase the chance they provide sensitive tokens without understanding where they are sent.
- Content
Static analysis
No suspicious patterns detected.