ClawHub
Back to skill

Security audit

Vtuber Avatar Skill

Security checks for vulnerabilities and agentic risk

Overview

This VTuber image skill does the expected external image-generation work, but it under-discloses some network and credential handling details that users should review before installing.

Review this skill before installing. It is not showing destructive behavior, persistence, or local data harvesting, but it sends prompts, reference IDs, and an API token to api.talesofai.com. Use a limited-scope token, avoid putting real tokens directly on the command line, and prefer a pinned or verified install source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party Installation Chain

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:32-35; README.md:12-16
Vulnerability Type: Unpinned third-party dependencies and mutable installation sources
Risk Level: Medium

Affected code in SKILL.md:

bash
## Install
```bash
npx skills add blammectrappora/vtuber-avatar-skill
text

**Affected code in `README.md`:**
```bash
## Install

**Via npx skills:**
```bash
npx skills add blammectrappora/vtuber-avatar-skill
text

### Technical Analysis

The documented installation command invokes `npx` without pinning the `skills` package to a reviewed version. The referenced skill is also identified without an immutable version, release tag, commit hash, or integrity checksum.

`npx` can download and execute package code during installation. Because both the installer package and skill reference are mutable, the effective code executed by users can differ from the code covered by this audit. This creates a supply-chain exposure if the package registry account, source repository, maintainer credentials, package namespace, or a future release is compromised.

No evidence establishes that the current upstream components are malicious. Exploitation depends on compromise or malicious modification of an upstream component.

### Attack Path

1. An attacker compromises the unpinned `skills` package, its publication account, the referenced skill repository, or another relevant upstream distribution channel.
2. The attacker publishes a modified release containing malicious installation or lifecycle behavior.
3. A user follows the documented `npx skills add blammectrappora/vtuber-avatar-skill` command.
4. `npx` retrieves the current mutable package release rather than a specifically audited artifact.
5. Attacker-controlled package or installation code executes in the user's environment.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges
...[truncated 450 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills installer to an explicitly reviewed version, for example by using a version-qualified package reference.
  2. Pin the installed skill to an immutable release or commit hash where the installation mechanism supports it.
  3. Publish and verify cryptographic checksums or signed release provenance for distributed artifacts.
  4. Use a lockfile or equivalent integrity metadata for every third-party package involved in installation.
  5. Document the expected package publisher, source repository, version, and checksum so users can verify provenance.
  6. Avoid recommending elevated execution and explicitly instruct users not to run the installer with administrator or root privileges.
  7. Periodically review pinned upstream versions and update them only after auditing the corresponding artifacts.

T09 · Insecure Skill Coding Practices

Warning
Location
vtuberavatar.js:9
Finding

API Token Exposed Through Process Arguments and Shell History

Content
View full analysis

Vulnerability Details

File Location: vtuberavatar.js:9-12,28-36; SKILL.md:12-16,21-23; README.md:42-45,69-76
Vulnerability Type: Insecure secret handling through command-line arguments
Risk Level: Medium

Affected code in vtuberavatar.js:

javascript
} else if (args[i] === "--token" && args[i + 1]) {
  tokenFlag = args[++i];
} else if (args[i] === "--ref" && args[i + 1]) {
  refUuid = args[++i];
}
javascript
// --- Token resolution ---
const TOKEN = tokenFlag;

if (!TOKEN) {
  console.error(
    '\n✗ Token required. Pass via: --token YOUR_TOKEN'
  );
  process.exit(1);
}

Affected usage example in SKILL.md:

bash
export NETA_TOKEN=your_token_here
node <script> "your prompt" --token "$NETA_TOKEN"
bash
node vtuberavatar.js "your description here" --token YOUR_TOKEN

Technical Analysis

The implementation obtains the API token exclusively from the --token command-line argument. Although package.json declares a required NETA_TOKEN environment variable and the documentation instructs users to export it, the script does not read process.env.NETA_TOKEN. Expanding "$NETA_TOKEN" into --token still places the resulting secret in the child process argument vector.

Command-line arguments may be visible in process inspection tools, endpoint monitoring systems, diagnostic logs, command telemetry, or process accounting data. Literal examples such as --token YOUR_TOKEN can additionally cause real credentials to be retained in shell history. Exposure depends on operating-system process visibility, local permissions, monitoring configuration, and how the user enters the command.

The script does not print the token directly, hardcode a token, or send it to an unrelated destination. Its intended network use is as the x-token header for api.talesofai.com; the vulnerability concerns local secret handling before an ...[truncated 1211 chars]

Remediation
View remediation

Remediation Suggestions

  1. Read the token from process.env.NETA_TOKEN by default:
    javascript
    const TOKEN = process.env.NETA_TOKEN || tokenFlag;
  2. Prefer the environment variable over the command-line flag, and deprecate --token because process arguments are not an appropriate secret channel.
  3. For higher-assurance deployments, support reading the token from a permission-restricted file, operating-system secret store, or standard input.
  4. Update all examples to invoke the script without expanding the token into command-line arguments:
    bash
    export NETA_TOKEN="your_token_here"
node vtuberavatar.js "your prompt"
  5. Ensure error messages, debug output, telemetry, and HTTP error handling never include request headers or token values.
  6. Document recommended file permissions and shell-history precautions for users who previously supplied tokens literally.
  7. Advise users who may have exposed a token through command history or process monitoring to revoke and rotate that token.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill description says it uses the Neta AI API, but the analyzed behavior indicates it actually contacts a different external service and supports undocumented reference-based image editing via '--ref'. This mismatch is dangerous because it can mislead users about where their prompts, images, and tokens are sent, and it hides additional data-handling functionality that may exfiltrate or process sensitive user-provided images unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README prominently advertises sending prompts and optional reference-image identifiers to an external API but does not clearly warn users that their prompts, metadata, and possibly linked image context are transmitted to a third party. In an avatar-generation skill, users may include personal, proprietary, or identifying content in prompts or references, making the lack of privacy notice materially risky.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to install and run tooling via npx skills without pinning a specific version. This creates a supply-chain risk because users may fetch and execute a newly published or compromised package version at install time. In skill-distribution context, install commands are high-trust and especially sensitive.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium
Category
YARA Match
Confidence
65% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

n eyes, shrine maiden outfit, cozy lo-fi aesthetic"

text

**With size option:**
```bash
node vtuberavatar.js "cute bunny vtuber, pastel pink hair, oversized hoodie" --size portrait

With a reference image (for style inheritance):

bash
node vtuberavatar.js "same character, winter outfit" --ref <picture_uuid>

Pass token inline:

bash
node vtuberavatar.js "dragon vtuber, scales, fierce expression" --token YOUR_TOKEN

The script prints a direct image URL to stdout on success.

Options

FlagValuesDefaultDescription
--sizesquare, portrait, landscape, tallsquareOutput image dimensions
--tokenstring—Override token (see Token Setup)
--refpicture_uuid—Inherit style from an existing image

Size dimensions

NameWidthHeight
square10241024
portrait8321216
landscape1216832
tall

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares only the Bash tool and does not specify any explicit tool scope or allowed network permissions, yet its documented behavior requires calling an external API. This creates an under-declared capability boundary: a reviewer or user may believe the skill is more constrained than it actually is, which increases the risk of unexpected outbound requests and token exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

The install command uses an unpinned 'npx skills' reference, which can fetch whatever version is current at execution time. That weakens supply-chain integrity because a future compromised or incompatible package/version could be installed without review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This code sends the generated request body, including the user prompt and token-bearing headers, to an external service at api.talesofai.com. External transmission is expected for an image-generation skill, but it remains a real security concern because sensitive inputs and credentials leave the local environment and are sent to a third party.

Content

Scanner excerpt · vtuberavatar.js (reported line 74)May include surrounding context.

js
// --- POST to make_image ---
async function makeImage() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This code sends the generated request body, including the user prompt and token-bearing headers, to an external service at api.talesofai.com. External transmission is expected for an image-generation skill, but it remains a real security concern because sensitive inputs and credentials leave the local environment and are sent to a third party.

Content

Scanner excerpt · vtuberavatar.js (reported line 74)May include surrounding context.

js
// --- POST to make_image ---
async function makeImage() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata says it uses the Neta AI image generation API, but the implementation actually sends requests to TalesOfAI endpoints. This mismatch is security-relevant because it misleads users about where their prompts and authentication token are being transmitted, undermining informed consent and trust boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code transmits both the user prompt and the supplied authentication token to a remote third-party service without any in-skill warning, confirmation, or disclosure. In this skill context, prompts may contain sensitive creative content and the token is a credential, so silent transmission increases the risk of unintended data exposure or credential misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The polling function repeatedly contacts the external TalesOfAI endpoint to retrieve task status and result URLs. While normal for asynchronous image generation, it still expands the data-sharing surface and reinforces that the skill depends on an external service not clearly disclosed by the manifest.

Content

Scanner excerpt · vtuberavatar.js (reported line 101)May include surrounding context.

js
// --- Poll for result ---
async function pollTask(taskUuid) {
  const url = `https://api.talesofai.com/v1/artifact/task/${taskUuid}`;
  const MAX_ATTEMPTS = 90;
  const INTERVAL_MS = 2000;

Static analysis

No suspicious patterns detected.