ClawHub
Back to skill

Security audit

Album Cover Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward album-cover image generator that sends prompts and a Neta token to the documented image API, with some install and token-handling practices users should treat carefully.

Before installing, prefer the ClawHub path or a pinned/verified source instead of the unpinned npx example, and use NETA_TOKEN or a secret manager rather than placing the API token directly on the command line. Do not send sensitive personal data or confidential creative prompts unless you accept the external API's handling of that data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned npx Installation Introduces Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28-31 and README.md:11-14
Vulnerability Type: Unpinned third-party package and mutable skill source
Risk Level: Medium

Vulnerable Code

SKILL.md:28-31:

bash
## Install
```bash
npx skills add omactiengartelle/album-cover-skill
text

`README.md:11-14`:

```bash
**Via npx skills:**
```bash
npx skills add omactiengartelle/album-cover-skill
text

### Technical Analysis

The documented installation command invokes the `skills` npm package through `npx` without pinning a package version. It also identifies the skill by a mutable repository-style reference rather than a verified release or immutable commit.

Consequently, the code resolved and executed during a future installation may differ from the code reviewed in this audit. If the npm package, its dependencies, the referenced skill source, or a maintainer account is compromised, the installation process could retrieve and execute modified content under the privileges of the installing user.

The audited project itself does not contain a malicious dependency or install script. This finding concerns the unsafe, mutable installation path documented by the project.

### Attack Path

1. An attacker compromises the `skills` npm package, one of its transitive dependencies, the referenced skill repository, or a relevant publisher account.
2. The attacker publishes or serves a modified version containing malicious installation behavior.
3. A user follows the documented unversioned `npx skills add` command.
4. `npx` resolves the currently available package rather than an audited, immutable version.
5. The compromised package or skill executes with the permissions of the user running the command.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on that user's permissions, the attacker could read or mod
...[truncated 266 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the skills npm package to a reviewed version, for example by using an exact semantic version rather than the latest available release.
  • Pin the installed skill to an immutable commit digest or a cryptographically verified release.
  • Publish checksums or signatures for released skill artifacts and verify them before execution.
  • Review and lock transitive dependencies used by the installer.
  • Avoid installation workflows that automatically execute mutable remote content.
  • Document how users can verify the package publisher, release signature, commit identifier, and artifact integrity before installation.

T09 · Insecure Skill Coding Practices

Note
Location
albumcover.js:11
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: albumcover.js:11-12, 27-28; also documented in SKILL.md:10-16 and README.md:55-62
Vulnerability Type: Sensitive credential accepted and recommended through process arguments
Risk Level: Low

Vulnerable Code

albumcover.js:11-12:

javascript
} else if (args[i] === "--token" && args[i + 1]) {
  tokenFlag = args[++i];
}

albumcover.js:27-28:

javascript
// --- Token resolution ---
const TOKEN = tokenFlag || process.env.NETA_TOKEN;

SKILL.md:10-16:

bash
Requires a Neta API token (free trial at <https://www.neta.art/open/>). Pass it via the `--token` flag.

```bash
node <script> "your prompt" --token YOUR_TOKEN
text

`README.md:55-62`:

```bash
Pass it via the `--token` flag:

```bash
node <script> "your prompt" --token YOUR_TOKEN
text

### Technical Analysis

The script accepts the Neta API token through the `--token` command-line option, and the documentation recommends this method. Command-line arguments are not an appropriate secret transport because they can be retained in interactive shell history, terminal logs, process telemetry, job-runner logs, and command auditing systems. On systems whose process-inspection policy allows it, another local user or process may also observe the arguments while the script is running.

The script supports the `NETA_TOKEN` environment variable, which avoids placing the token directly in the command line, but the command-line option takes precedence and remains the prominently documented workflow. Environment variables may still be exposed through diagnostics or inherited by child processes, so a protected secret store or standard-input mechanism is preferable for higher-security deployments.

### Attack Path

1. A user follows the documentation and invokes the script with `--token` followed by a valid API token.
2. The complete command is reco
...[truncated 945 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove or deprecate the --token argument and do not place secrets in process arguments.
  • Retrieve the token from a protected secret manager, operating-system credential store, or non-echoing standard-input prompt.
  • If environment-variable support is retained, make NETA_TOKEN the documented default and warn that environment exposure must be controlled.
  • Replace all token-bearing command examples with secret-safe examples.
  • Ensure CI systems inject the token through masked secret facilities and redact it from diagnostics.
  • Add explicit token redaction to error reporting and telemetry.
  • Recommend rotation of any token previously exposed through shell history or logs and deletion of affected records where feasible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Chaining Abuse

High
Category
Tool Misuse
Confidence
76% confidence
Finding

The README encourages piping a URL returned by the script directly into xargs curl, which normalizes blind fetching of remote content from an external API response. If the returned URL is unexpected, malicious, or points to internal/unsafe resources, this pattern can facilitate unsafe download behavior and chaining into later tooling without user inspection.

Content

Scanner excerpt · README.md (reported line 83)May include surrounding context.

bash
node albumcover.js "cyberpunk album cover, rain, neon" | pbcopy   # copy URL
node albumcover.js "jazz" | xargs curl -o cover.jpg               # download

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose says the skill uses the Neta AI API, but the analyzed behavior indicates it actually contacts a different external service and supports undocumented reference-based generation via --ref. This mismatch is dangerous because users may provide prompts, tokens, or images under false assumptions about where their data is sent and what capabilities are exercised, undermining informed consent and security review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly states that prompts are sent to an external image-generation API and also supports passing a reference image UUID, but it does not clearly warn users about third-party data sharing, retention, or privacy implications. Users may unknowingly transmit sensitive creative concepts, personal data embedded in prompts, or identifiers tied to prior images to an external service.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill declares only tools: Bash and does not constrain permissions or allowed tools, even though its behavior requires network access and may access environment-provided secrets such as the API token. This weakens least-privilege controls and increases the chance the skill can make unintended external requests or interact with sensitive runtime state without clear user visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description does not warn users that their prompts and API token are transmitted to an external image-generation service. This creates a meaningful data-exposure risk because users may unknowingly send sensitive creative content, personal information, or credentials to a third party.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The phrase 'Use when someone asks to generate or create ai album cover generator images' is an activation description in a markdown file, so SQP-1 applies. 'generate or create' is broad and the file does not provide exclusion conditions or narrower trigger examples, which could cause unintended invocation from ordinary requests about image creation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
74% confidence
Finding

Using npx skills add omactiengartelle/album-cover-skill without a pinned version makes installation non-reproducible and exposes users to supply-chain risk if a newer or compromised package/version is published later. An attacker controlling the package or a dependency update could cause different code to be installed than what was originally reviewed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · albumcover.js (reported line 74)May include surrounding context.

js
// --- Submit job ---
async function makeImage() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · albumcover.js (reported line 74)May include surrounding context.

js
// --- Submit job ---
async function makeImage() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · albumcover.js (reported line 98)May include surrounding context.

js
// --- Submit job ---
async function makeImage() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code sends the user-supplied prompt to an external API and authenticates with a token, but the script provides no user-facing notice that prompt content will be transmitted off-system. Aside from requiring a token, there is no print, comment, or prompt disclosing the external data transfer or its privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script reads an authentication token from process.env.NETA_TOKEN, which is a sensitive credential source. While this is functionally necessary, there is no accompanying disclosure or comment warning that the tool will read credentials from the environment and use them in outbound requests.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
albumcover.js:28