Album Cover Skill

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:28 PM UTC
• Version:
  1.5.7

Overview

This is a straightforward album-cover generator that sends prompts and a Neta token to the documented external image API.

Install only if you trust this publisher and are comfortable sending album-cover prompts, optional reference UUIDs, and a Neta API token to api.talesofai.com. Use a dedicated or easily rotated token, prefer NETA_TOKEN over putting secrets in shell history, and avoid sensitive or proprietary prompt content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares only the Bash tool but does not explicitly declare permissions, even though its documented behavior requires network access to call the Neta API and likely access to sensitive input such as an API token. This mismatch weakens sandboxing and user awareness because the runtime capabilities exceed what is transparently declared, increasing the risk of unintended data exposure or policy bypass.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill metadata and comments indicate Neta AI usage, but the code actually sends authenticated requests to TalesOfAI endpoints. This mismatch can mislead users into disclosing prompts and tokens to a different third party than advertised, undermining informed consent and trust boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest claims the skill uses the Neta AI API, but the implementation posts data to and polls from TalesOfAI. In a security context, provider misrepresentation is dangerous because users may supply credentials or sensitive prompts under false assumptions about where their data is going.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README states the skill is powered by an external API, but it does not clearly warn users that their prompts, tokens, and optional reference-image identifiers are transmitted to a third-party service for processing. In a skill that handles creative prompts and potentially reusable image references, this omission can mislead users about data handling and create privacy and compliance risks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill transmits user prompts, image-generation parameters, and metadata to a remote API without clearly warning the user at runtime. In this context, the danger is amplified because the skill already misrepresents the service provider, so users may unknowingly send potentially sensitive creative content to an unexpected external service.

VirusTotal

65/65 vendors flagged this skill as clean.