Polaroid Photo Generator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:56 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward polaroid-style image generator that sends user-provided prompts and a Neta token to the disclosed image-generation service.

Install only if you are comfortable using the Neta/talesofai service for image generation. Avoid placing real secrets or sensitive personal/business details in prompts, prefer passing the token from a protected environment variable where possible, and consider pinning the install source to a reviewed version or commit.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Installer and Mutable Skill Source

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-33; README.md:10-19
Vulnerability Type: Supply-chain risk through unpinned remote installer execution
Risk Level: Medium

Vulnerable Code

SKILL.md:30-33:

bash

## Install
```bash
npx skills add blammectrappora/polaroid-photo-generator

text

`README.md:10-19`:

```bash
## Install

**Via npx skills:**
```bash
npx skills add blammectrappora/polaroid-photo-generator

Via ClawHub:

bash

clawhub install polaroid-photo-generator

text

### Technical Analysis

The installation instructions invoke an unversioned package through `npx` and identify the Skill through a mutable repository or registry name. Neither the installer package nor the installed Skill is pinned to an audited version, commit hash, or integrity digest.

`npx` can download and execute the currently resolved release of a package. Consequently, the effective installer and Skill content executed by a user can differ from the files reviewed in this audit. A compromised package owner, registry account, repository, or distribution channel could replace a legitimate release with malicious content.

This finding concerns the documented installation path. The audited project itself contains no malicious dependency declarations or embedded installation scripts.

### Attack Path

1. An attacker compromises the npm package, Skill registry entry, source repository, maintainer account, or another component in the distribution chain.
2. The attacker publishes a modified installer package or replaces the mutable Skill release with malicious content.
3. A user follows the documented `npx skills add` or unpinned ClawHub installation command.
4. The package manager resolves the attacker-controlled current release rather than a previously audited immutable version.
5. Malicious installation logic executes with the privileges of the user running the command.

### Im
...[truncated 432 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills installer package to a reviewed version instead of allowing npx to resolve the latest release.
• Pin the Skill source to an immutable release tag or, preferably, a full commit hash.
• Publish and verify cryptographic integrity hashes or signed release attestations.
• Document the expected package registry and reject unexpected registry overrides.
• Recommend reviewing the resolved package and using npx options that prevent implicit installation where practical.
• Establish a release process that audits each pinned version before updating installation documentation.

T09 · Insecure Skill Coding Practices

Warning

• Location: polaroidphotogenerator.js:20

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: polaroidphotogenerator.js:20-23, 39-45; SKILL.md:13-23; README.md:22-55
Vulnerability Type: Sensitive token exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

polaroidphotogenerator.js:20-23:

js

const PROMPT = positional[0];
const tokenFlag = getFlag("--token");
const sizeFlag = getFlag("--size") || "square";
const refFlag = getFlag("--ref");

const TOKEN = tokenFlag;

polaroidphotogenerator.js:39-45:

js

const HEADERS = {
  "x-token": TOKEN,
  "x-platform": "nieta-app/web",
  "content-type": "application/json",
};

SKILL.md:13-23:

bash

## Token

Requires a Neta API token (free trial at <https://www.neta.art/open/>). Pass it via the `--token` flag.

```bash
node <script> "your prompt" --token YOUR_TOKEN

When to use

Use when someone asks to generate or create polaroid photo generator images.

Quick start

bash

node polaroidphotogenerator.js "your description here" --token YOUR_TOKEN

text

`README.md:30-35`:

```bash
Pass it via the `--token` flag:

```bash
node <script> "your prompt" --token YOUR_TOKEN

Usage

bash

node polaroidphotogenerator.js "<description>" --token YOUR_TOKEN [--size <size>] [--ref <uuid>]

text

### Technical Analysis

The program requires the Neta API token to be supplied as a `--token` command-line argument. Command-line secrets can be recorded in shell history, terminal session logs, automation logs, process-execution telemetry, and error reports. On systems where process arguments are visible to other users or monitoring services, the token may also be exposed while the process runs.

The token is legitimately transmitted over HTTPS to the documented service as the `x-token` header. No token logging or transmission to an undisclosed endpoint was found. The 
...[truncated 1156 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer a protected environment variable such as NETA_TOKEN over a command-line argument.
• Support reading the token from standard input through a hidden interactive prompt when an environment variable is unavailable.
• If backward compatibility requires --token, deprecate it and display a warning explaining the shell-history and process-list risks.
• Ensure CI and automation systems inject the token through their secret-management facilities and mask it in logs.
• Never include token values in exceptions, debug output, telemetry, or API error reports.
• Document token rotation and immediate revocation procedures for suspected exposure.
• Apply the least privilege and shortest practical lifetime to issued API tokens.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx skills add ... without pinning a specific version, which can cause users to fetch and execute whatever package version is current at install time. If the upstream package, dependency chain, or namespace is compromised, users could execute unintended code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explains token setup and usage but does not clearly warn that user prompts, and potentially reference-image identifiers, are transmitted to a third-party API for processing. In a photo-generation skill, users may submit sensitive personal, business, or regulated content, so the omission can lead to unintentional data disclosure and privacy/compliance issues.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares only tools: Bash and does not restrict or disclose the network capability implied by use of the external Neta API. This can cause an agent or user to invoke a skill that transmits prompts or related data off-platform without an explicit scope boundary, weakening least-privilege and informed-consent controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation does not warn users that prompts and --ref reference image UUIDs are sent to an external image-generation API. Without clear disclosure, users may unknowingly transmit sensitive personal, proprietary, or identifying content to a third party, especially since image prompts and references can contain private material.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger text, 'Use when someone asks to generate or create polaroid photo generator images,' is broad and underspecified, which can cause the skill to be invoked in contexts where the user did not clearly consent to using an external third-party API. Over-broad routing increases the chance of accidental data sharing or misuse of tokens and external services.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

Using npx skills add blammectrappora/polaroid-photo-generator without a pinned version makes installation depend on whatever package/version is current at execution time. That creates a supply-chain risk: a later compromised or malicious update could be pulled silently by users or agents.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The hardcoded remote endpoint means all generation requests are sent to an external domain outside the local trust boundary. In the context of a creative image-generation skill this is functional rather than deceptive, but it still creates a supply-chain and privacy risk because users must trust the remote operator with their prompts and token.

Content

Scanner excerpt · polaroidphotogenerator.js (reported line 78)May include surrounding context.

js

async function main() {
  console.error(`Generating polaroid photo: "${PROMPT}" (${sizeFlag} ${width}×${height})...`);

  const makeRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The hardcoded remote endpoint means all generation requests are sent to an external domain outside the local trust boundary. In the context of a creative image-generation skill this is functional rather than deceptive, but it still creates a supply-chain and privacy risk because users must trust the remote operator with their prompts and token.

Content

Scanner excerpt · polaroidphotogenerator.js (reported line 78)May include surrounding context.

js

async function main() {
  console.error(`Generating polaroid photo: "${PROMPT}" (${sizeFlag} ${width}×${height})...`);

  const makeRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The polling request repeatedly sends authenticated requests to the external API to retrieve task results, extending the exposure of the token and metadata to the third-party service. This is less severe than the initial upload because it does not send the full prompt body again, but it still maintains external authenticated communication that users may not expect.

Content

Scanner excerpt · polaroidphotogenerator.js (reported line 108)May include surrounding context.

js

await sleep(2000);

    const pollRes = await fetch(
      `https://api.talesofai.com/v1/artifact/task/${task_uuid}`,
      { headers: HEADERS }
    );