Back to skill

Security audit

Neon Art Generator

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward neon image generator that sends prompts to a disclosed external image API and does not show hidden persistence, destructive behavior, or unrelated local access.

Install only if you are comfortable sending image prompts, optional reference IDs, and a Neta API token to TalesOfAI/Neta. Avoid putting confidential information in prompts, use a revocable or limited token when possible, and remember that command-line tokens may appear in shell history or process listings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares only Bash tooling but does not declare network permissions, even though its documented usage depends on calling the external Neta API. Undeclared network access weakens the trust boundary for users and agents, because the skill can transmit prompts, tokens, and possibly image references to a third-party service without an explicit permission signal.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill sends the user's prompt and API token to a third-party service, but it does not clearly warn the user that their input will leave the local environment and be processed externally. In an agent/skill setting, this is a real privacy and credential-handling issue because prompts may contain sensitive data and the token is supplied on the command line, increasing risk of unintended disclosure.

External Transmission

Medium
Category
Data Exfiltration
Content
};
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),
Confidence
88% confidence
Finding
fetch('https://api.talesofai.com/v3/make_image', { method: 'POST'

External Transmission

Medium
Category
Data Exfiltration
Content
};
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),
Confidence
88% confidence
Finding
https://api.talesofai.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.