Neta Creative

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:18 AM UTC
• Version: 0.1.0

Overview

The skill is mostly aligned with Neta creative generation, but it deserves review because it uses a credential, sends creative inputs to an external API, installs a mutable global CLI package, and includes some tag-browsing guidance outside its stated scope.

Install only if you trust the Neta CLI publisher and are comfortable sending prompts, lyrics, and image references to Neta services. Prefer a pinned package version instead of @latest, keep NETA_TOKEN in a secure environment variable store, avoid submitting private or rights-restricted media, and treat the hashtag/tag discovery examples as out of scope for this creative skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned Global Installation of a Mutable npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 20–34 **Vulnerability Type**: Supply-chain risk from an unpinned global dependency **Risk Level**: Medium ### Vulnerable Code ```bash Also ensure the latest Neta CLI is installed: neta-cli --version 0.8.0 npm i @talesofai/neta-skills@latest -g pnpm add -g @talesofai/neta-skills@latest ``` ### Technical Analysis The Skill instructs users or agents to install `@talesofai/neta-skills@latest` globally. The `latest` tag is mutable, so the installed package can differ from the version that was reviewed. Although the document displays version `0.8.0`, neither installation command enforces that version or verifies package integrity. npm-compatible package installation can execute package lifecycle scripts. A global installation also modifies the user's shared command environment rather than an isolated project environment. Consequently, compromise of the publisher account, registry package, release pipeline, or a future `latest` release could introduce arbitrary code at installation time or replace the expected `neta-cli` executable. The audit found no evidence that the currently referenced package is malicious. The vulnerability is the unsafe dependency acquisition and installation pattern. ### Attack Path 1. An attacker compromises the package publisher, release pipeline, or registry package, or causes a malicious release to become the `latest` version. 2. A user or agent follows the prerequisite instructions and runs one of the global installation commands. 3. The package manager resolves the mutable `latest` tag to the attacker-controlled release. 4. Malicious package contents or lifecycle scripts execute with the privileges of the account running npm or pnpm. 5. The package can replace or spoof `neta-cli`, alter the shared user toolchain, access data available to that account, or influence subsequent Skill operations. ### Impact Assessment Succes ...[truncated 637 chars]
• Remediation: ## Remediation Suggestions 1. Replace the mutable tag with an audited exact version: ```bash npm install --global @talesofai/neta-skills@0.8.0 ``` 2. Verify the downloaded package against an expected integrity hash or trusted package provenance before installation. 3. Prefer a project-local, locked dependency over a global installation. Commit and enforce a lockfile so dependency resolution is reproducible. 4. Disable package lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts --save-exact @talesofai/neta-skills@0.8.0 ``` 5. If lifecycle scripts are required, review them and the complete transitive dependency tree before approving a version. 6. Run the CLI in a restricted environment with minimal filesystem access and expose `NETA_TOKEN` only for commands that require authenticated API access. 7. Document the expected package publisher, registry, version, and checksum, and fail closed when any value differs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly requires a sensitive `NETA_TOKEN` environment variable but provides no guidance on secure handling, storage, rotation, or the privacy implications of sending user prompts and media to an external API. In an agent setting, this omission can lead users to expose credentials in logs, shell history, shared environments, or unsafe debugging workflows.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file explicitly documents tag-based character research workflows, including browsing hashtag-linked characters and analyzing traits for creative direction. That exceeds the manifest’s stated creative-only scope and can cause an agent to perform broader discovery/browsing tasks that the skill was not supposed to handle, weakening scope boundaries and potentially enabling unintended data access or policy bypass through the wrong skill.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The 'Use hashtags to narrow down' section instructs the agent to inspect hashtags and list characters under a tag, which directly conflicts with the manifest’s prohibition on tag/category research. This creates a clear scope-confusion path where the agent may invoke prohibited discovery functions under the guise of character lookup, increasing the chance of unauthorized or policy-inconsistent behavior.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

- **Continue calling tools until the task is complete** or you must confirm critical information. Minimize unnecessary back‑and‑forth with the user.
- Tool calls do not share implicit context: always pass full, explicit parameters for every call.
- **Do not** use any tools that are not provided.
- **Retry policy**: if a tool call fails, you may retry at most once, and you **must** retry with the **exact same parameters**. Do not silently change logic or arguments.

## Reference context

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This document instructs users to generate songs, images, and videos via `neta-cli` using free-form prompts, lyrics, and image URLs, but it does not warn that this content may be transmitted to an external service. Users could unknowingly send sensitive creative drafts, copyrighted lyrics, personal data, or private image URLs off-platform, creating privacy and confidentiality risk. In the context of a creative-generation skill, this is more dangerous because the workflow explicitly encourages supplying rich user-authored content and externally hosted asset URLs.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The caching examples instruct users to write character details and search results to local files without any warning about persistence, retention, or sensitivity of stored data. While the data shown is not highly sensitive by default, undocumented local persistence can still create privacy, compliance, or accidental data exposure risks, especially if prompts, search history, or user-associated content are later included in cached outputs.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The example command uses the phrase "A Japanese high school girl..." as a default sample prompt, which imposes a specific locale/national identity in the natural-language guidance. Under the language/locale policy, files should not force a specific locale or similar regional framing unless it is optional, user-chosen, or clearly justified.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: This file is a markdown document, so natural-language policy checks apply. The guidance, templates, and examples consistently assume English-language prompts and lyrics, which can be interpreted as forcing a specific language/locale without user opt-in.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file includes command examples that pass `--image_source` values from HTTPS URLs to `make_video`, which implies transmitting user-provided image data to an external service. The document presents these workflows as normal usage but does not include any warning about privacy, external upload, or ensuring the source image is safe to share.

Static analysis

No suspicious patterns detected.