Security audit

Neta Community

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Neta community browsing tool, but it also enables authenticated public interactions and relies on an unpinned global CLI install without enough user-control guidance.

Install only if you are comfortable giving the Neta CLI an authenticated token and letting the agent browse and potentially affect your community account. Prefer a pinned, locally installed CLI version, use a minimally scoped token, confirm every like/favorite/comment/follow before execution, and avoid saving authenticated responses in shared temporary paths or using broad debug logging.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Unpinned Third-Party Package Installed Globally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/interactive-feed.md:137
Finding: Authenticated API Responses Written to Predictable Shared Temporary Files
Content: View full analysis
/tmp/page0.json # Extract biz_trace_id BIZ_TRACE_ID=$(cat /tmp/page0.json | jq -r '.page_data.biz_trace_id') ``` The same predictable-path pattern is repeated elsewhere in the file, including `/tmp/page1.json`, `/tmp/feed_cache.json`, `/tmp/page1.prefetch.json`, and `/tmp/response.json`. ### Technical Analysis The guide redirects authenticated API responses to fixed filenames in the shared `/tmp` directory. It does not establish a restrictive `umask`, securely create the files, validate file ownership, prevent symbolic-link following, or remove the files after use. The responses can contain personalized feed data, creator information, collection metadata, and `biz_trace_id` session-continuity identifiers. Although a `biz_trace_id` is not established to be an authentication credential, it is session-related data that should not be unnecessarily exposed or retained. Predictable filenames also introduce a local race and symbolic-link risk. A process with access to the same temporary directory may pre-create one of the paths as a symbolic link. Shell redirection could then truncate or overwrite another file writable by the victim. A hostile local process could also replace cached responses and influence downstream processing. ### Attack Path 1. An attacker with access to the same host predicts a documented filename such as `/tmp/page0.json`. 2. The attacker either monitors the path for newly written data or pre-creates it as a symbolic link to another file writable by the victim. 3. The victim runs the documented command with an authenticated Neta session. 4. The shell writes the API response through the predictable path. 5. The attacker reads retained respo ...[truncated 728 chars]
Remediation: View remediation
"$TMP_DIR/page0.json" || exit 1 BIZ_TRACE_ID=$(jq -er '.page_data.biz_trace_id' "$TMP_DIR/page0.json") || exit 1 ``` ]]>

T09 · Insecure Skill Coding Practices

Note

Location: references/interactive-feed.md:314
Finding: Unrestricted Debug Logging for a Token-Authenticated Client
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill manifest explicitly says not to use this skill for taxonomy/keyword-level research, but the body documents hashtag research and character-search capabilities anyway. This inconsistency can cause an agent to route research tasks to the wrong skill, bypassing intended separation of responsibilities and increasing the chance of unsafe or unintended actions in a community-interaction context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger language is broad enough to match ordinary browsing requests, which raises the likelihood of the skill being invoked when the user did not specifically intend community actions. In this skill's context, unintended invocation matters because the same skill can also perform account-affecting interactions such as likes, so over-broad activation expands the chance of accidental side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises liking and interacting with community content without clearly warning that these are account-affecting actions or requiring explicit user confirmation. In a community skill tied to an authenticated token, this can lead to unauthorized or accidental social actions being performed on the user's behalf.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions tell the agent to switch to neta-suggest for systematic research or complex category/keyword filtering, but later sections present this same skill as supporting tag research and character-search workflows. Contradictory routing guidance is dangerous because an agent may ignore the intended handoff and continue using a skill with broader interactive powers than necessary.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation instructs users to use a community browsing/interaction skill to generate images and create new posts, which exceeds the skill's declared scope. This scope drift is dangerous because it can cause an agent to invoke capabilities the user or platform policy did not intend, weakening tool-routing boundaries and enabling unauthorized content creation workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file recommends tag-based character research even though the skill metadata explicitly says this skill should not be used for taxonomy/keyword-level research. That contradiction can misroute agent behavior into disallowed research flows, undermining safety and separation between skills with different intended permissions and data-access patterns.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document directs the skill toward taxonomy/hashtag research and creative-direction analysis, which conflicts with the stated scope of the community skill as browsing and interacting with community content. Scope drift like this can cause an agent to invoke unintended capabilities or answer requests using the wrong skill, weakening safety boundaries and policy routing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Including an image-generation step in a community-browsing skill materially expands the effective capability from passive research into content creation. In an agent setting, this can bypass intended separation of duties between discovery and generation skills, leading to unauthorized or policy-incompatible tool execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file includes commands that write API responses to local files in character_cache/ and search_cache/, but it does not warn users that fetched data will be persisted on disk. Because SQP-2 applies to markdown files when behaviours could affect user data, privacy, or system integrity, the omission of any storage warning is a valid safety-quality concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file says it applies only to hashtag commands, but later instructs use of character-detail and image-generation commands outside that declared boundary. This inconsistency can mislead an agent into over-broad tool use and undermines trust in the skill’s safety and routing assumptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Line L293 contains Chinese text ("重要") embedded in otherwise English guidance, which introduces a language/locale inconsistency in the skill content. The file does not indicate that multilingual output is optional or that a non-English locale is required for this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The examples save personalized interactive feed responses to predictable /tmp files, which can persist locally and may be readable by other users or processes depending on system configuration. Because feed responses may contain personalized recommendations, identifiers, and session metadata such as biz_trace_id, this creates an avoidable local data exposure risk even though the document is only instructional.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.