ClawHub
Back to skill

Security audit

Mascot Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward mascot image-generation skill that calls an external image API, with privacy and install-hygiene cautions but no evidence of malicious behavior.

Install only from a source you trust, prefer a pinned installer or reviewed release when possible, and avoid putting sensitive prompts or internal asset references into this tool. Because the token is passed on the command line, consider clearing shell history or adapting usage to an environment variable or secret manager before using a real account token.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Unpinned Third-Party CLI Package Is Downloaded and Executed During Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:30-33; README.md:8-15
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable code snippets (SKILL.md:30-33):

markdown
## Install
```bash
npx skills add blammectrappora/mascot-generator
text

**Vulnerable code snippets (`README.md:8-15`):**
```markdown
## Install

Using the ClawHub skills CLI:

```bash
npx skills add blammectrappora/mascot-generator
text

### Technical Analysis

The documented installation procedure invokes `npx skills` without specifying an audited package version or integrity value. If the `skills` package is not already available locally, `npx` can download its current release from the configured package registry and execute it immediately.

Consequently, the code executed during installation is mutable and can differ from the code that was reviewed. This creates a supply-chain exposure if the upstream package, package publisher account, registry, or dependency tree is compromised. The installed skill reference is also not pinned to a specific reviewed revision.

### Attack Path

1. An attacker compromises the upstream `skills` package, its publisher account, a transitive dependency, or the relevant distribution channel.
2. The attacker publishes a malicious version under the package name used by the documented command.
3. A user follows the installation instructions and runs `npx skills add blammectrappora/mascot-generator`.
4. `npx` resolves and downloads the mutable package release.
5. The downloaded package executes with the invoking user's permissions.
6. Malicious code can then access resources available to that user before or while installing the skill.

### Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the user running the installation command. Depending on that user's permissions, the attacker could rea
...[truncated 276 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the installer CLI to a specifically audited version, such as npx skills@<reviewed-version>.
  • Pin the installed skill to an immutable version, commit hash, or signed release where the installer supports it.
  • Use a lockfile and registry integrity metadata for all executable dependencies.
  • Prefer a locally installed, reviewed CLI invoked with installation disabled, rather than allowing npx to retrieve an arbitrary current release.
  • Configure and document the expected trusted registry.
  • Verify package signatures or published checksums before execution.
  • Periodically review pinned versions and update them through an explicit security-review process.

T09 · Insecure Skill Coding Practices

Warning
Location
mascotgenerator.js:14
Finding

API Token Is Accepted Through a Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: mascotgenerator.js:14-24, mascotgenerator.js:49-58; usage documented at SKILL.md:10-20 and README.md:58-66
Vulnerability Type: Sensitive token exposure through process arguments and shell history
Risk Level: Medium

Vulnerable code snippet (mascotgenerator.js:14-24):

javascript
function parseArgs(argv) {
  const args = { _: [] };
  for (let i = 0; i < argv.length; i++) {
    const a = argv[i];
    if (a === '--size') args.size = argv[++i];
    else if (a === '--token') args.token = argv[++i];
    else if (a === '--ref') args.ref = argv[++i];
    else if (a === '--help' || a === '-h') args.help = true;
    else args._.push(a);
  }
  return args;
}

Vulnerable code snippet (mascotgenerator.js:49-58):

javascript
const tokenFlag = args.token;
const TOKEN = tokenFlag;

if (!TOKEN) {
  console.error('\n✗ Token required. Pass via: --token YOUR_TOKEN');
  console.error('  Get yours at: https://www.neta.art/open/');
  process.exit(1);
}

Documented invocation (SKILL.md:12-16):

bash
node <script> "your prompt" --token YOUR_TOKEN

Technical Analysis

The program requires the Neta API token to be supplied through the --token command-line option and retrieves it from process.argv. Command-line arguments are not an appropriate secret transport mechanism because they can be retained in shell history and may be exposed through process inspection, monitoring agents, diagnostic collection, terminal logging, or command auditing.

The token is legitimately used as the x-token request header for https://api.talesofai.com; no evidence was found that the application intentionally logs that header. The weakness arises before transmission because the documented interface places the secret in observable process metadata.

Attack Path

  1. A user follows the documentation and invokes the program ...[truncated 996 chars]
Remediation
View remediation

Remediation Suggestions

  • Stop requiring secrets through command-line arguments.
  • Read the token from a dedicated environment variable, such as NETA_API_TOKEN, while recognizing that environment access must also be restricted.
  • For interactive use, support a hidden terminal prompt that does not echo or retain the token in shell history.
  • For automation, support a permission-restricted credential file or operating-system secret manager.
  • Update all examples and help text so they no longer encourage --token YOUR_TOKEN.
  • If temporary backward compatibility is required, deprecate --token, emit a warning without printing its value, and prioritize the secure credential source.
  • Document token rotation and revocation procedures and recommend least-privilege, short-lived credentials where supported.
  • Ensure exceptions, debug output, telemetry, and HTTP diagnostics always redact authentication headers and token values.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented purpose says the skill uses the Neta AI API, but the analyzed behavior indicates it actually communicates with a different external service (api.talesofai.com) and exposes reference-image/style inheritance behavior not accurately described. Misrepresenting the remote endpoint is dangerous because it defeats informed consent, can redirect prompts or tokens to an unexpected third party, and is a strong indicator of deceptive design.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README describes prompt-based generation and optional reference-image UUIDs but does not clearly warn users that their prompts and identifiers are transmitted to an external third-party API. This can lead users to unknowingly send sensitive business ideas, branding concepts, or internal asset references off-platform, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The README instructs users to run npx skills add ... without pinning a version, which can fetch and execute whatever package version is current at install time. That creates a supply-chain risk: a compromised or malicious future release of the CLI could run arbitrary code on the user's system during installation.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium
Category
YARA Match
Confidence
65% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

y:

bash
clawhub install mascot-generator

Usage

bash
node mascotgenerator.js "your description here" --token YOUR_TOKEN

Examples

Generate a coffee shop mascot:

bash
node mascotgenerator.js "a smiling coffee bean character wearing a barista apron, holding a tiny cup" --token YOUR_TOKEN

Generate an esports team mascot in landscape:

bash
node mascotgenerator.js "fierce wolf mascot for an esports team, wearing headphones, neon accents" \
  --token YOUR_TOKEN \
  --size landscape

Use a reference image UUID for style inheritance:

bash
node mascotgenerator.js "friendly robot mascot for a tech startup" \
  --token YOUR_TOKEN \
  --ref 123e4567-e89b-12d3-a456-426614174000

Options

FlagDescriptionDefault
--tokenNeta API token (required)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill declares only the Bash tool and does not define an explicit tool scope or permissions boundary, even though its documented behavior requires outbound network access to an external image-generation API. This weakens reviewability and can let users invoke a network-capable workflow without clear least-privilege constraints or transparent disclosure of what external access is required.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The phrase "Use when someone asks to generate or create brand mascot generator images" is broad and unclear about the exact trigger scope. It does not provide specific invocation phrases, constraints, or exclusion examples, which could cause the skill to activate on loosely related everyday requests about mascots or image creation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

Using npx skills add blammectrappora/mascot-generator without a pinned version allows the installed package or referenced skill loader to change over time, creating a supply-chain risk. A later upstream update could introduce malicious behavior or breaking changes that users would execute implicitly during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code sends the user-supplied token in the x-token header to an external API. While the help text says a token is required, it does not clearly warn that the credential will be transmitted to a third-party service, which is the kind of disclosure SQP-2 expects for sensitive credentials and network transmission.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mascotgenerator.js (reported line 98)May include surrounding context.

js
let submitRes;
  try {
    submitRes = await fetch(`https://api.talesofai.com/v3/make_image`, {
      method: 'POST',
      headers,
      body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mascotgenerator.js (reported line 139)May include surrounding context.

js
let submitRes;
  try {
    submitRes = await fetch(`https://api.talesofai.com/v3/make_image`, {
      method: 'POST',
      headers,
      body: JSON.stringify(body),

Static analysis

No suspicious patterns detected.