ClawHub

Texture Art Generator

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward image-generation helper that sends the user’s prompt and Neta token to the documented remote image API, with no evidence of hidden persistence or unrelated system access.

Install only if you are comfortable sending image prompts, optional reference IDs, and a Neta API token to api.talesofai.com. Use a limited token where possible and do not include secrets, private data, or confidential concepts in prompts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill invokes an external API and therefore has network capability, but the manifest does not declare that permission. This creates a trust and review gap: users and platform security controls may underestimate what the skill can do, including transmitting prompts, tokens, or referenced image identifiers to a third party.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README instructs users to send prompts and an API token to a third-party image-generation service, but it does not clearly warn that user inputs may leave the local environment and be processed by an external provider. This creates a privacy and data-handling risk because users may unknowingly submit sensitive prompts, proprietary concepts, or credentials to a remote service under that provider's retention and logging policies.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal