ClawHub
Back to skill

Security audit

Stained Glass Art Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to generate stained-glass images as advertised, but it handles API tokens and prompt data with incomplete provider disclosure and uses unpinned install guidance.

Review this before installing. Use only non-sensitive prompts, verify that your Neta token is intended for use with api.talesofai.com, prefer a scoped and revocable token, avoid placing real tokens directly on the command line, and avoid unpinned npx installation when a pinned or ClawHub-native install path is available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Unpinned Third-Party Installer Execution Through npx

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
stainedglassartgenerator.js:3
Finding

API Token Exposure Through Command-Line Arguments

Content
View full analysis
). Pass it via the `--token` flag. ```bash node
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx skills add blammectrappora/stained-glass-art-generator without pinning a specific version. This can cause users to fetch and execute whatever code is currently published under that package or tag at install time, creating a supply-chain risk if the package is updated maliciously or the account is compromised. Because this is an installation command in documentation, it directly encourages unsafe execution behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares only tools: Bash and does not explicitly constrain tool permissions or allowed capabilities, even though its documented behavior requires calling an external API using a token. That mismatch can cause the runtime to grant broader-than-necessary execution/network behavior through Bash, increasing the chance of unintended outbound access or misuse of the provided API token.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
81% confidence
Finding

The install instruction uses npx skills add blammectrappora/stained-glass-art-generator without pinning a specific version or immutable reference. This creates a supply-chain risk: users may install whatever version is current at execution time, including a later compromised or malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script tells users to obtain a token from neta.art/open, then uses that token in the x-token header when calling talesofai.com endpoints. That is a credential-routing mismatch that may expose user tokens to an unexpected service and is especially concerning because the skill is presented as a branded integration for a different provider.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata and token instructions point users to Neta AI, but the code actually sends authenticated requests to api.talesofai.com. This mismatch can mislead users into providing credentials and prompts to a different third-party service than advertised, undermining informed consent and creating a supply-chain style trust issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The hardcoded api.talesofai.com destination confirms that data is sent to an external service distinct from the one named in the skill metadata. While outbound networking is normal for an image generator, the undisclosed provider mismatch makes this transmission materially more dangerous in context.

Content

Scanner excerpt · stainedglassartgenerator.js (reported line 71)May include surrounding context.

js
console.error("");

async function createTask() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The hardcoded api.talesofai.com destination confirms that data is sent to an external service distinct from the one named in the skill metadata. While outbound networking is normal for an image generator, the undisclosed provider mismatch makes this transmission materially more dangerous in context.

Content

Scanner excerpt · stainedglassartgenerator.js (reported line 71)May include surrounding context.

js
console.error("");

async function createTask() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code transmits the user's free-text prompt and optional reference identifier to an external API without any explicit disclosure at runtime that this content will leave the local environment. In a skill context, prompts may contain sensitive or proprietary information, so undisclosed external sharing increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The polling request repeatedly contacts the same third-party service to retrieve task results, extending the duration and volume of external communication. By itself this is routine, but in the context of misleading provider identity it reinforces that the skill continuously interacts with an unexpected remote backend.

Content

Scanner excerpt · stainedglassartgenerator.js (reported line 100)May include surrounding context.

js
await new Promise((r) => setTimeout(r, interval));

    const res = await fetch(
      `https://api.talesofai.com/v1/artifact/task/${taskUuid}`,
      { headers }
    );

Static analysis

No suspicious patterns detected.