Neta Community

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:18 AM UTC
• Version: 0.1.0

Overview

The skill is mostly a coherent Neta community browsing tool, but it also enables authenticated public interactions and relies on an unpinned global CLI install without enough user-control guidance.

Install only if you are comfortable giving the Neta CLI an authenticated token and letting the agent browse and potentially affect your community account. Prefer a pinned, locally installed CLI version, use a minimally scoped token, confirm every like/favorite/comment/follow before execution, and avoid saving authenticated responses in shared temporary paths or using broad debug logging.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: Unpinned Third-Party Package Installed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32–36 **Vulnerability Type**: Supply-chain exposure through an unpinned globally installed dependency **Risk Level**: Medium ### Vulnerable Code ```bash npm i @talesofai/neta-skills@latest -g ``` ```bash pnpm add -g @talesofai/neta-skills@latest ``` ### Technical Analysis The installation instructions retrieve whichever package version the mutable `latest` tag references at installation time. Consequently, the installed code can change after this Skill has been reviewed. The global installation option also exposes the broader user environment to package lifecycle scripts and executable files. The package implementation is not included in the audited project. Its lifecycle scripts, API destinations, token handling, and runtime behavior therefore cannot be verified from this artifact. This is especially significant because `SKILL.md:22` instructs users to place `NETA_TOKEN` in the environment used by the CLI. Network access and token-based authentication are necessary for the declared community API functionality. However, obtaining executable code through an unpinned global installation exceeds the minimum safe installation privileges needed to provide that functionality. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, publication process, or a future release assigned to `latest`. 2. A user follows the documented npm or pnpm global installation command. 3. The package manager downloads and executes the attacker-controlled package version, including any permitted lifecycle scripts. 4. The malicious package runs with the installing user's privileges. 5. It can inspect the process environment, including `NETA_TOKEN` if present, and access files available to that user. 6. The compromised CLI can subsequently intercept API inputs, alter responses, or transmit account data to an attacker-controlled service. ### Impact Assessment Successful exploitation ...[truncated 461 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact reviewed version rather than using `@latest`. 2. Verify package integrity through a lockfile, registry integrity hash, signed provenance, or an equivalent reproducible mechanism. 3. Prefer a project-local installation executed with minimal privileges instead of a global installation. 4. Review and document the package's lifecycle scripts before installation. 5. Use `--ignore-scripts` where compatible with the package's legitimate operation. 6. Document the expected npm registry, package publisher, API domains, and certificate requirements. 7. Run the CLI in a restricted environment containing only the required token and files. 8. Scope `NETA_TOKEN` to the minimum API permissions necessary and support prompt revocation and rotation. 9. Vendor or include the reviewed CLI source when feasible so its network and credential behavior can be audited together with the Skill. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/interactive-feed.md:137
• Finding: Authenticated API Responses Written to Predictable Shared Temporary Files<![CDATA[ ## Vulnerability Details **File Location**: `references/interactive-feed.md`, lines 137–142 **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Low ### Vulnerable Code ```bash # First request (page 0) neta-cli request_interactive_feed \ --page_index 0 \ --page_size 10 > /tmp/page0.json # Extract biz_trace_id BIZ_TRACE_ID=$(cat /tmp/page0.json | jq -r '.page_data.biz_trace_id') ``` The same predictable-path pattern is repeated elsewhere in the file, including `/tmp/page1.json`, `/tmp/feed_cache.json`, `/tmp/page1.prefetch.json`, and `/tmp/response.json`. ### Technical Analysis The guide redirects authenticated API responses to fixed filenames in the shared `/tmp` directory. It does not establish a restrictive `umask`, securely create the files, validate file ownership, prevent symbolic-link following, or remove the files after use. The responses can contain personalized feed data, creator information, collection metadata, and `biz_trace_id` session-continuity identifiers. Although a `biz_trace_id` is not established to be an authentication credential, it is session-related data that should not be unnecessarily exposed or retained. Predictable filenames also introduce a local race and symbolic-link risk. A process with access to the same temporary directory may pre-create one of the paths as a symbolic link. Shell redirection could then truncate or overwrite another file writable by the victim. A hostile local process could also replace cached responses and influence downstream processing. ### Attack Path 1. An attacker with access to the same host predicts a documented filename such as `/tmp/page0.json`. 2. The attacker either monitors the path for newly written data or pre-creates it as a symbolic link to another file writable by the victim. 3. The victim runs the documented command with an authenticated Neta session. 4. The shell writes the API response through the predictable path. 5. The attacker reads retained respo ...[truncated 728 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory with `mktemp -d` rather than using fixed paths. 2. Set `umask 077` before creating files that may contain authenticated responses. 3. Register a shell trap to remove temporary data on normal exit and interruption. 4. Quote every generated pathname and verify file ownership before reading it. 5. Avoid persisting complete responses when only `biz_trace_id` is required. 6. Use an in-memory pipeline where practical, while ensuring command failures are handled safely. 7. If persistent caching is necessary, use a user-private cache directory with restrictive permissions and documented expiration and deletion rules. 8. Validate cached JSON structure before using any extracted value. A safer pattern is: ```bash umask 077 TMP_DIR=$(mktemp -d) || exit 1 trap 'rm -rf "$TMP_DIR"' EXIT neta-cli request_interactive_feed \ --page_index 0 \ --page_size 10 > "$TMP_DIR/page0.json" || exit 1 BIZ_TRACE_ID=$(jq -er '.page_data.biz_trace_id' "$TMP_DIR/page0.json") || exit 1 ``` ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/interactive-feed.md:314
• Finding: Unrestricted Debug Logging for a Token-Authenticated Client<![CDATA[ ## Vulnerability Details **File Location**: `references/interactive-feed.md`, line 314 **Vulnerability Type**: Potential sensitive-data exposure through excessive debug logging **Risk Level**: Low ### Vulnerable Code ```bash DEBUG=* neta-cli request_interactive_feed --page_index 0 ``` ### Technical Analysis Setting `DEBUG=*` enables every debug namespace recognized by the CLI and its dependencies. The CLI is used in an environment that contains `NETA_TOKEN` and makes authenticated API requests. Depending on the external CLI's implementation, unrestricted debug output may include request URLs, headers, environment configuration, session identifiers, response bodies, or other account-associated metadata. The external CLI source is absent from this project, so it is not possible to confirm whether authorization headers and tokens are reliably redacted. The finding is therefore based on unsafe logging guidance rather than proof that the current CLI emits the token. Debug output can be captured by terminal history systems, CI logs, Agent transcripts, support bundles, or centralized monitoring. These destinations may have broader readership and longer retention than the original authenticated session. ### Attack Path 1. A user encounters a feed problem and follows the documented debugging command. 2. The wildcard debug setting enables verbose output from the CLI and its dependencies. 3. A component logs sensitive request or response details without adequate redaction. 4. The output is retained in a terminal transcript, CI system, Agent conversation, support ticket, or log aggregator. 5. A party with access to that log obtains account-associated data or, if emitted, the authentication token. 6. If a valid token is exposed, the party can invoke the Neta API with the permissions assigned to that token until it expires or is revoked. ### Impact Assessment The likely impact is disclosure of API metadata, personalized response content, and session identi ...[truncated 394 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `DEBUG=*` with a narrowly scoped, documented debug namespace known not to emit authentication data. 2. Ensure the CLI redacts authorization headers, cookies, tokens, signed URLs, and sensitive query parameters before logging. 3. Disable request and response body logging by default. 4. Add an explicit warning not to run verbose debugging in shared terminals, CI jobs, or Agent transcripts. 5. Provide a sanitization procedure for logs before they are attached to support requests. 6. Use short-lived, least-privilege tokens during troubleshooting and rotate them if accidental exposure is suspected. 7. Document where debugging output is written and define a short retention period. 8. Add automated tests that fail if known token values appear in debug output. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill manifest explicitly says not to use this skill for taxonomy/keyword-level research, but the body documents hashtag research and character-search capabilities anyway. This inconsistency can cause an agent to route research tasks to the wrong skill, bypassing intended separation of responsibilities and increasing the chance of unsafe or unintended actions in a community-interaction context.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger language is broad enough to match ordinary browsing requests, which raises the likelihood of the skill being invoked when the user did not specifically intend community actions. In this skill's context, unintended invocation matters because the same skill can also perform account-affecting interactions such as likes, so over-broad activation expands the chance of accidental side effects.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill advertises liking and interacting with community content without clearly warning that these are account-affecting actions or requiring explicit user confirmation. In a community skill tied to an authenticated token, this can lead to unauthorized or accidental social actions being performed on the user's behalf.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The instructions tell the agent to switch to neta-suggest for systematic research or complex category/keyword filtering, but later sections present this same skill as supporting tag research and character-search workflows. Contradictory routing guidance is dangerous because an agent may ignore the intended handoff and continue using a skill with broader interactive powers than necessary.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to use a community browsing/interaction skill to generate images and create new posts, which exceeds the skill's declared scope. This scope drift is dangerous because it can cause an agent to invoke capabilities the user or platform policy did not intend, weakening tool-routing boundaries and enabling unauthorized content creation workflows.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file recommends tag-based character research even though the skill metadata explicitly says this skill should not be used for taxonomy/keyword-level research. That contradiction can misroute agent behavior into disallowed research flows, undermining safety and separation between skills with different intended permissions and data-access patterns.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The document directs the skill toward taxonomy/hashtag research and creative-direction analysis, which conflicts with the stated scope of the community skill as browsing and interacting with community content. Scope drift like this can cause an agent to invoke unintended capabilities or answer requests using the wrong skill, weakening safety boundaries and policy routing.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Including an image-generation step in a community-browsing skill materially expands the effective capability from passive research into content creation. In an agent setting, this can bypass intended separation of duties between discovery and generation skills, leading to unauthorized or policy-incompatible tool execution.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: This markdown file includes commands that write API responses to local files in `character_cache/` and `search_cache/`, but it does not warn users that fetched data will be persisted on disk. Because SQP-2 applies to markdown files when behaviours could affect user data, privacy, or system integrity, the omission of any storage warning is a valid safety-quality concern.

Intent-Code Divergence

Low

• Confidence: 86% confidence
• Finding: The file says it applies only to hashtag commands, but later instructs use of character-detail and image-generation commands outside that declared boundary. This inconsistency can mislead an agent into over-broad tool use and undermines trust in the skill’s safety and routing assumptions.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: Line L293 contains Chinese text ("重要") embedded in otherwise English guidance, which introduces a language/locale inconsistency in the skill content. The file does not indicate that multilingual output is optional or that a non-English locale is required for this skill.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The examples save personalized interactive feed responses to predictable /tmp files, which can persist locally and may be readable by other users or processes depending on system configuration. Because feed responses may contain personalized recommendations, identifiers, and session metadata such as biz_trace_id, this creates an avoidable local data exposure risk even though the document is only instructional.

Static analysis

No suspicious patterns detected.