Security audit

3d Anime Poster Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a straightforward image generator that sends prompts and a user-supplied Neta token to its documented external API, with install and token-handling cautions but no hidden or destructive behavior.

Install only if you are comfortable sending your image prompts, optional reference UUIDs, and Neta API token to api.talesofai.com. Prefer the ClawHub install route or a pinned installer when available, avoid putting long-lived tokens directly in shell history, and do not submit confidential prompts or image references unless you accept the third-party service's handling of that data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Unpinned Package Execution Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: 3danimepostergenerator.js:3
Finding: API Token Exposed Through Command-Line Arguments
Content: View full analysis
"your prompt" --token YOUR_TOKEN ``` ``` ### Technical Analysis The application requires the API token to be supplied as a command-line argument and retrieves it from `process.argv`. Command-line arguments are not an appropriate primary transport for long-lived secrets because they can be exposed through: - Shell command history. - Process inspection utilities and process accounting. - Monitoring, debugging, audit, or telemetry systems that record process arguments. - Terminal logs, copied command transcripts, and automation logs. The exact visibility of process arguments to other users depends on operating-system and process-isolation settings. Nevertheless, shell history and operational logging remain common disclosure channels even where process inspection is restricted. The script does not print the token itself, and the audited code sends it only as the `x-token` header to the documented HTTPS API host. The weakness is therefore the local handling and documented entry mechanism, not a hardcoded credential or explicit token logging operation. ### Attack Path 1. A user follows the documentation and enters a valid API token using `--token`. 2. The complete command is retained in shell history, process metadata, an automation log, or a monitoring system. 3. A local user, ...[truncated 683 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The hardcoded remote host indicates this skill is designed to communicate with an external image-generation service, which creates a trust boundary crossing. In this context that is expected functionality, but it still constitutes a genuine security/privacy concern because all generated content requests and associated metadata are sent off-box to a non-local service.
Content: Scanner excerpt · 3danimepostergenerator.js (reported line 72)May include surrounding context.
js
console.error(`Creating 3D anime poster (${size} ${chosen.width}x${chosen.height})...`); console.error(`Prompt: ${prompt}`); const res = await fetch("https://api.talesofai.com/v3/make_image", { method: "POST", headers: HEADERS, body: JSON.stringify(body),

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The hardcoded remote host indicates this skill is designed to communicate with an external image-generation service, which creates a trust boundary crossing. In this context that is expected functionality, but it still constitutes a genuine security/privacy concern because all generated content requests and associated metadata are sent off-box to a non-local service.
Content: Scanner excerpt · 3danimepostergenerator.js (reported line 72)May include surrounding context.
js
console.error(`Creating 3D anime poster (${size} ${chosen.width}x${chosen.height})...`); console.error(`Prompt: ${prompt}`); const res = await fetch("https://api.talesofai.com/v3/make_image", { method: "POST", headers: HEADERS, body: JSON.stringify(body),

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: The polling request repeatedly transmits the authentication header to the same external service to retrieve job status. While lower risk than the initial upload, it still extends exposure of the token to a third-party service and increases external dependency and metadata leakage about user activity.
Content: Scanner excerpt · 3danimepostergenerator.js (reported line 100)May include surrounding context.
js
await new Promise((r) => setTimeout(r, 2000)); const pollRes = await fetch( `https://api.talesofai.com/v1/artifact/task/${taskUuid}`, { headers: HEADERS } );

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README says the skill is powered by an external image-generation API and supports prompts plus reference-image UUIDs, but it does not clearly warn that user prompts and reference identifiers are transmitted to a third-party service. This can lead users to disclose sensitive text or image-linked data under the false assumption processing is local, creating privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific version, which can cause execution of whatever package version is current at install time. If the upstream package or dependency chain is compromised, users may fetch and run unexpected code, and README-driven install commands are commonly copied verbatim.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill uses a Bash tool and instructs users to run a Node-based generator that relies on an external Neta API token, which implies outbound network access, but the manifest does not declare any tool scope restrictions such as permissions or allowed-tools. This weakens least-privilege controls and can allow broader-than-expected execution/network behavior if the skill or its backing script is modified or abused.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The install instruction uses npx skills add omactiengartelle/3d-anime-poster-generator without pinning a specific version. This creates a supply-chain risk because future package changes, dependency compromise, or account takeover could cause users to install unexpected or malicious code under the same name.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.