ClawHub
Back to skill

Security audit

Noir Photo Generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward image-generation wrapper that sends a prompt and user-provided API token to a disclosed external image service.

Install only if you are comfortable sending your prompts and Neta/TalesOfAI token to api.talesofai.com. Avoid using the token command in shared terminals, CI logs, or recorded sessions, and rotate the token if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill invokes a Node script that calls the external Neta API and therefore has network capability, but the manifest does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users and platforms may not realize the skill transmits prompts and API tokens off-box, which can expose sensitive input or bypass expected permission review.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.