Retro Travel Poster Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:41 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but it needs review because it handles an API token in a risky way and its main skill instructions under-disclose the actual API domain receiving that token.

Review this before installing. Use a low-privilege or disposable Neta token, avoid pasting real tokens into shell history, and confirm you are comfortable sending prompts, reference IDs, and the token to api.talesofai.com. Prefer a pinned release or verified artifact rather than the floating npx install command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: retrotravelpostergenerator.js:84

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: retrotravelpostergenerator.js:17-20, 84-90; usage is also documented in SKILL.md:17-21, 26-29 and README.md:47-55
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

javascript

function parseArgs(args) {
  const out = { prompt: null, size: 'portrait', token: null, ref: null };
  const positional = [];
  for (let i = 0; i < args.length; i++) {
    const a = args[i];
    if (a === '--size') { out.size = args[++i]; }
    else if (a === '--token') { out.token = args[++i]; }

javascript

async function main() {
  const { prompt: promptArg, size, token: tokenFlag, ref } = parseArgs(argv.slice(2));
  const TOKEN = tokenFlag;
  if (!TOKEN) {
    console.error('\n✗ Token required. Pass via: --token YOUR_TOKEN');
    console.error('  Get yours at: https://www.neta.art/open/');
    exit(1);
  }

The documented invocation explicitly places the secret on the command line:

bash

node retrotravelpostergenerator.js "your description here" --token YOUR_TOKEN

Technical Analysis

The Neta API token is accepted exclusively as a command-line argument. Command-line arguments are not an appropriate secret-transport mechanism because they may be recorded in shell history, terminal logs, process-monitoring systems, debugging output, or operating-system process metadata.

On systems where process arguments are visible to other users or monitoring agents, the token can remain observable while the script is submitting and polling the image-generation task. Even after the process exits, the command can remain in the invoking user's shell history. The script does not disclose the token in its own normal output, but that does not mitigate exposure caused by the invocation mechanism.

Sending the token in the x-token header over HTTPS to api.talesofai.com is consistent wit ...[truncated 1425 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an environment variable, such as NETA_API_TOKEN, rather than a command-line flag:

   javascript

   const TOKEN = process.env.NETA_API_TOKEN;
   

2. For interactive use, support reading the token from a non-echoing terminal prompt.

3. For automation, support reading the token from standard input or a permission-restricted credential file, without printing it.

4. If --token must remain for compatibility, mark it deprecated and emit a warning explaining its process-list and shell-history risks.

5. Update all examples in README.md and SKILL.md so they do not encourage placing a real secret directly in command history.

6. Ensure errors, debugging output, and telemetry redact token values.

7. Recommend short-lived, least-privilege tokens and document immediate revocation procedures for suspected exposure.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-34; equivalent mutable installation instructions also appear in README.md:10-17
Vulnerability Type: Unpinned third-party package and Skill installation
Risk Level: Medium

Vulnerable Code

markdown

## Install
```bash
npx skills add blammectrappora/retro-travel-poster-generator

text

The README also presents mutable package sources:

```bash
npx skills add blammectrappora/retro-travel-poster-generator

bash

clawhub install retro-travel-poster-generator

Technical Analysis

The installation instructions invoke npx skills without a fixed package version and install the Skill by a mutable owner/name reference without a commit, release version, or integrity digest. Consequently, the code executed or installed in the future may differ from the code that was audited.

npx may download and execute the currently resolved version of the named package. If its registry account, publishing pipeline, package ownership, or dependency chain is compromised, an attacker can substitute malicious package content. Likewise, a mutable Skill identifier can resolve to a later release that has not undergone this audit.

No malicious dependency or installation payload was found in the inspected project, and package.json declares no runtime dependencies or lifecycle scripts. This finding concerns the unsafe, non-reproducible installation method rather than confirmed malicious content in the present artifact.

Attack Path

1. An attacker compromises the publishing account, registry package, source repository, or release process associated with skills or the referenced Skill.
2. The attacker publishes a malicious new version under the same mutable identifier.
3. A user follows the documented unpinned npx or ClawHub installation command.
4. The package manager retrieves the attacker-controlled current version rather than the audited ar ...[truncated 827 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills CLI to a reviewed exact version rather than allowing npx to select the current release.
2. Pin the installed Skill to an immutable release, commit hash, or content digest.
3. Publish and verify checksums or cryptographic signatures for release artifacts.
4. Use a lockfile where supported and require integrity metadata for downloaded packages.
5. Prefer a trusted registry and document the expected publisher identity and repository.
6. In automated environments, use non-floating, preapproved artifacts from an internal mirror.
7. Review package lifecycle scripts and dependency changes before updating pinned versions.
8. Update both SKILL.md and README.md so every installation method resolves reproducibly to the audited artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose says the skill uses the Neta AI API, but analysis indicates it actually contacts undeclared external endpoints (api.talesofai.com) and supports reference-based inheritance not properly disclosed. Hidden service substitution is especially dangerous because users may provide API tokens or sensitive prompts under false assumptions about where data is sent, enabling credential misuse, data leakage, or deceptive routing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to install the skill via npx skills add ... without pinning a specific package/version. This can cause users to fetch and execute whatever version is current at install time, increasing supply-chain risk if the package is later compromised, replaced, or updated with malicious code. The image-generation context does not reduce this risk because the dangerous action is package execution during installation, not poster generation itself.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares only tools: Bash and provides no permissions or allowed-tools scoping, despite behavior indicating external network access. That mismatch weakens execution boundaries and transparency, increasing the chance the skill can reach undeclared remote services or exfiltrate prompts, tokens, or generated content without clear user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L20 says to use the skill when someone asks to "generate or create retro travel poster generator images," which is ambiguous and awkwardly phrased, and does not clearly constrain what requests should or should not activate this skill. It lacks specific trigger examples or exclusion conditions, increasing the chance of unintended invocation for generic image-generation requests.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

Using npx skills add blammectrappora/retro-travel-poster-generator without pinning a version makes installation non-reproducible and exposes users to supply-chain risk if the upstream package changes or is compromised later. An attacker controlling the package, account, or dependency chain could deliver different code than what was reviewed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This code transmits user prompts, optional reference identifiers, and the supplied token to an external TalesOfAI endpoint despite the skill being presented as a Neta AI integration. External transmission is expected for an image-generation skill, but the undisclosed destination and credential forwarding make this materially dangerous and deceptive.

Content

Scanner excerpt · retrotravelpostergenerator.js (reported line 40)May include surrounding context.

js

if (ref) {
    body.inherit_params = { collection_uuid: ref, picture_uuid: ref };
  }
  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: {
      'x-token': token,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This code transmits user prompts, optional reference identifiers, and the supplied token to an external TalesOfAI endpoint despite the skill being presented as a Neta AI integration. External transmission is expected for an image-generation skill, but the undisclosed destination and credential forwarding make this materially dangerous and deceptive.

Content

Scanner excerpt · retrotravelpostergenerator.js (reported line 40)May include surrounding context.

js

if (ref) {
    body.inherit_params = { collection_uuid: ref, picture_uuid: ref };
  }
  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: {
      'x-token': token,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill advertises Neta AI but actually sends prompts and the supplied token to TalesOfAI endpoints, which is a strong indicator of deceptive credential collection or undisclosed third-party data transfer. This mismatch breaks user trust and can cause users to disclose credentials intended for one service to another service entirely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The polling request repeatedly sends the provided token to the same undisclosed TalesOfAI service, increasing credential exposure and confirming continued communication with a provider different from the one advertised. While polling is normal behavior for async jobs, doing so against a misrepresented service deepens the trust and data-handling concern.

Content

Scanner excerpt · retrotravelpostergenerator.js (reported line 67)May include surrounding context.

js

async function pollTask(taskUuid, token) {
  for (let i = 0; i < 90; i++) {
    await new Promise((r) => setTimeout(r, 2000));
    const res = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
      headers: {
        'x-token': token,
        'x-platform': 'nieta-app/web',

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The CLI explicitly instructs users to obtain a token from Neta, but the code uses that token in x-token headers to api.talesofai.com. This is dangerous because it can trick users into handing over credentials under false pretenses, enabling credential misuse, unauthorized API access attempts, or account compromise if tokens are accepted across services or reused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code requires the user to pass a token via the command line and then sends that token in HTTP headers to a remote service. While the script logs task progress, it does not warn users that command-line arguments may be exposed in shell history or process listings, nor that their prompt content and token will be transmitted to an external API.

Content

No source excerpt is available for this finding.