Neta Space

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:17 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward Neta browsing helper, but users should be careful with its unpinned global CLI installation instructions.

Install only if you intend to use Neta space browsing and are comfortable providing a NETA_TOKEN to the Neta CLI. Prefer pinning a reviewed package version instead of @latest, avoid global installs where possible, and do not invoke the neta-creative add command unless you also want that separate skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Packages and Mutable Installation Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–41 and 124–128
Vulnerability Type: Unpinned and unreviewed third-party dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md, lines 31–41:

bash

neta-cli --version
0.8.0

bash

npm i @talesofai/neta-skills@latest -g

bash

pnpm add -g @talesofai/neta-skills@latest

SKILL.md, lines 124–128:

bash

npx skills add talesofai/neta-skills/skills/neta-creative

Technical Analysis

The Skill directs users or agents to install third-party software using the mutable @latest package tag and an unpinned repository reference. Although the document displays CLI version 0.8.0, the installation commands do not enforce that version.

Package installation can execute lifecycle scripts and install executable code that is absent from the audited project. Consequently, the effective behavior cannot be verified from SKILL.md. Future package releases, repository changes, or compromised transitive dependencies could introduce arbitrary behavior after this audit.

Global installation increases exposure by placing third-party executables in shared command locations. The Skill also requires a NETA_TOKEN environment variable. While no direct credential exfiltration is present in the reviewed file, subsequently executed dependency code may be able to read that token and other data accessible to the invoking process.

Attack Path

1. An attacker compromises the package publisher account, source repository, release pipeline, or a transitive dependency.
2. The attacker publishes malicious code under the latest package version or modifies the unpinned repository content.
3. A user or agent follows the documented global npm/pnpm installation command or invokes the npx skills add workflow.
4. The package manager retrieves the attacker-controlled version because no immutable version, commit, lockfil ...[truncated 989 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version, such as @talesofai/neta-skills@0.8.0, after independently verifying that release.
2. Pin repository-based installations to an audited immutable commit hash rather than a branch or mutable repository path.
3. Publish and verify package integrity hashes or signed provenance before installation.
4. Avoid global installation. Use a project-local dependency with a lockfile and execute it from an isolated environment.
5. Disable package lifecycle scripts during installation where operationally possible, then explicitly review and authorize any required scripts.
6. Run the CLI with least privilege in a sandbox or container with restricted filesystem and network access.
7. Provide NETA_TOKEN only to commands that require it. Use a narrowly scoped, short-lived token and ensure it is not exposed to installation processes.
8. Document the expected API domains and restrict outbound network access to those destinations.
9. Add dependency scanning, release review, and automated verification of transitive dependencies to the maintenance process.
10. Audit the actual CLI and referenced neta-creative Skill before recommending their execution.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs use of npx skills add ... without pinning an exact package/version, which allows execution or installation of whatever package version is current at runtime. In a skill context, this creates a supply-chain risk: a compromised upstream package, typo-squatted dependency path, or breaking update could lead to untrusted code execution on the analyst/operator system.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest says to use this skill when the user talks about "worlds/spaces/universes/scenes," which are broad everyday content terms rather than a tightly bounded invocation trigger. Although it includes one exclusion for media creation, it does not give clear negative examples or tighter constraints for when ordinary discussion should not invoke the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.