Neta Suggest

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:17 AM UTC
• Version: 0.1.0

Overview

The skill’s Neta recommendation purpose is coherent, but it asks users to install a mutable global CLI package and use an API token without enough scoping or credential-safety guidance.

Install only if you trust the @talesofai/neta-skills package and publisher. Prefer a pinned reviewed version and a project-local install, keep NETA_TOKEN scoped to the minimum permissions, do not expose the token globally or in logs, and use the skill only for Neta content discovery rather than general web trends or brainstorming.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Mutable Third-Party Package Installed Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–30
Vulnerability Type: Unpinned global dependency installation
Risk Level: Medium

bash

npm i @talesofai/neta-skills@latest -g

bash

pnpm add -g @talesofai/neta-skills@latest

Technical Analysis

The Skill instructs users to install the mutable latest release of @talesofai/neta-skills globally. The reviewed project provides no lockfile, integrity hash, vendored implementation, or source code from which the installed package's behavior can be verified.

Because the latest tag can resolve to a different package version over time, the effective executable payload may change after this Skill has been reviewed. If the package publisher account, release process, or registry entry is compromised, a malicious release could execute code through package lifecycle scripts during installation or through the installed neta-cli executable.

Global installation increases exposure by placing the executable in a shared command path rather than isolating it to the project. The document does not instruct users to use sudo, so administrative execution is not established; nevertheless, the package receives the permissions of the account performing the installation.

The Skill also requires a NETA_TOKEN for subsequent CLI use. Network authentication is necessary for its declared API functionality, and the reviewed file does not prove unauthorized exfiltration. However, an untrusted replacement CLI could potentially access this environment variable when invoked.

Attack Path

1. An attacker compromises the package publisher account, package registry entry, or upstream release pipeline.
2. The attacker publishes a malicious version and assigns it to the mutable latest distribution tag.
3. A user follows the documented npm or pnpm global installation command.
4. The package manager downloads the attacker-controlled release without a reviewed version pin or project lockfile.

...[truncated 1117 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version, such as @talesofai/neta-skills@0.8.0, after verifying that version corresponds to the expected CLI.
2. Prefer a project-local dependency over global installation to reduce command-path and cross-project exposure.
3. Commit an appropriate lockfile and verify registry integrity metadata so installations resolve to a known artifact.
4. Document the official package registry, source repository, publisher identity, and expected API endpoints.
5. Verify package provenance or signatures where supported by the package registry.
6. Disable package lifecycle scripts during installation where operationally feasible, and explicitly review any scripts required by the dependency before enabling them.
7. Run the CLI as a non-privileged user in a restricted environment with access only to required files and network destinations.
8. Scope NETA_TOKEN to the minimum API permissions, avoid persistent global exposure of the variable, and rotate it if a package compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description activates on broad phrases like 'user has no clear goal' or 'wants topic/idea suggestions,' which overlap with many generic requests and can cause the skill to be invoked outside a narrowly scoped domain. Over-broad routing increases the chance of unnecessary tool use, unwanted data exposure to the external service, or interference with more appropriate skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction examples use vague triggers such as 'find me some ideas' and 'what's trending now' without clearly limiting them to the Neta platform or taxonomy workflow. This ambiguity can lead an orchestrator or model to over-select the skill for broad user intents, causing scope creep and unnecessary external API queries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to rely on the NETA_TOKEN environment variable but provides no credential-handling safeguards, masking guidance, or warning not to expose secrets in outputs, logs, or errors. In an agent environment, this can normalize secret access and increase the risk of accidental disclosure through command execution, debugging, or troubleshooting steps.

Content

No source excerpt is available for this finding.