Neta Creative

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:18 AM UTC
• Version: 0.1.0

Overview

The skill is mostly aligned with Neta creative generation, but it deserves review because it uses a credential, sends creative inputs to an external API, installs a mutable global CLI package, and includes some tag-browsing guidance outside its stated scope.

Install only if you trust the Neta CLI publisher and are comfortable sending prompts, lyrics, and image references to Neta services. Prefer a pinned package version instead of @latest, keep NETA_TOKEN in a secure environment variable store, avoid submitting private or rights-restricted media, and treat the hashtag/tag discovery examples as out of scope for this creative skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Global Installation of a Mutable npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–34
Vulnerability Type: Supply-chain risk from an unpinned global dependency
Risk Level: Medium

Vulnerable Code

bash

Also ensure the latest Neta CLI is installed:

neta-cli --version
0.8.0

npm i @talesofai/neta-skills@latest -g

pnpm add -g @talesofai/neta-skills@latest

Technical Analysis

The Skill instructs users or agents to install @talesofai/neta-skills@latest globally. The latest tag is mutable, so the installed package can differ from the version that was reviewed. Although the document displays version 0.8.0, neither installation command enforces that version or verifies package integrity.

npm-compatible package installation can execute package lifecycle scripts. A global installation also modifies the user's shared command environment rather than an isolated project environment. Consequently, compromise of the publisher account, registry package, release pipeline, or a future latest release could introduce arbitrary code at installation time or replace the expected neta-cli executable.

The audit found no evidence that the currently referenced package is malicious. The vulnerability is the unsafe dependency acquisition and installation pattern.

Attack Path

1. An attacker compromises the package publisher, release pipeline, or registry package, or causes a malicious release to become the latest version.
2. A user or agent follows the prerequisite instructions and runs one of the global installation commands.
3. The package manager resolves the mutable latest tag to the attacker-controlled release.
4. Malicious package contents or lifecycle scripts execute with the privileges of the account running npm or pnpm.
5. The package can replace or spoof neta-cli, alter the shared user toolchain, access data available to that account, or influence subsequent Skill operations.

Impact Assessment

Succes ...[truncated 637 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable tag with an audited exact version:

   bash

   npm install --global @talesofai/neta-skills@0.8.0
   

2. Verify the downloaded package against an expected integrity hash or trusted package provenance before installation.
3. Prefer a project-local, locked dependency over a global installation. Commit and enforce a lockfile so dependency resolution is reproducible.
4. Disable package lifecycle scripts during installation where compatible:

   bash

   npm install --ignore-scripts --save-exact @talesofai/neta-skills@0.8.0
   

5. If lifecycle scripts are required, review them and the complete transitive dependency tree before approving a version.
6. Run the CLI in a restricted environment with minimal filesystem access and expose NETA_TOKEN only for commands that require authenticated API access.
7. Document the expected package publisher, registry, version, and checksum, and fail closed when any value differs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly requires a sensitive NETA_TOKEN environment variable but provides no guidance on secure handling, storage, rotation, or the privacy implications of sending user prompts and media to an external API. In an agent setting, this omission can lead users to expose credentials in logs, shell history, shared environments, or unsafe debugging workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file explicitly documents tag-based character research workflows, including browsing hashtag-linked characters and analyzing traits for creative direction. That exceeds the manifest’s stated creative-only scope and can cause an agent to perform broader discovery/browsing tasks that the skill was not supposed to handle, weakening scope boundaries and potentially enabling unintended data access or policy bypass through the wrong skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'Use hashtags to narrow down' section instructs the agent to inspect hashtags and list characters under a tag, which directly conflicts with the manifest’s prohibition on tag/category research. This creates a clear scope-confusion path where the agent may invoke prohibited discovery functions under the guise of character lookup, increasing the chance of unauthorized or policy-inconsistent behavior.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/collection-remix.md (reported line 9)May include surrounding context.

md

- **Continue calling tools until the task is complete** or you must confirm critical information. Minimize unnecessary back‑and‑forth with the user.
- Tool calls do not share implicit context: always pass full, explicit parameters for every call.
- **Do not** use any tools that are not provided.
- **Retry policy**: if a tool call fails, you may retry at most once, and you **must** retry with the **exact same parameters**. Do not silently change logic or arguments.

## Reference context

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This document instructs users to generate songs, images, and videos via neta-cli using free-form prompts, lyrics, and image URLs, but it does not warn that this content may be transmitted to an external service. Users could unknowingly send sensitive creative drafts, copyrighted lyrics, personal data, or private image URLs off-platform, creating privacy and confidentiality risk. In the context of a creative-generation skill, this is more dangerous because the workflow explicitly encourages supplying rich user-authored content and externally hosted asset URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The caching examples instruct users to write character details and search results to local files without any warning about persistence, retention, or sensitivity of stored data. While the data shown is not highly sensitive by default, undocumented local persistence can still create privacy, compliance, or accidental data exposure risks, especially if prompts, search history, or user-associated content are later included in cached outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example command uses the phrase "A Japanese high school girl..." as a default sample prompt, which imposes a specific locale/national identity in the natural-language guidance. Under the language/locale policy, files should not force a specific locale or similar regional framing unless it is optional, user-chosen, or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This file is a markdown document, so natural-language policy checks apply. The guidance, templates, and examples consistently assume English-language prompts and lyrics, which can be interpreted as forcing a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file includes command examples that pass --image_source values from HTTPS URLs to make_video, which implies transmitting user-provided image data to an external service. The document presents these workflows as normal usage but does not include any warning about privacy, external upload, or ensuring the source image is safe to share.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.