ClawHub
Back to skill

Security audit

Anime Character Generator

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate anime image generator, but it should be reviewed because it handles an API token through command-line arguments and documents an unpinned installer path.

Review before installing. Prefer a pinned or ClawHub-managed install path, avoid pasting long-lived API tokens directly into shell commands, and use a short-lived or low-scope Neta token where possible. Do not send sensitive prompts or private reference UUIDs unless you are comfortable sharing them with the Neta/TalesofAI service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
animecharactergenerator.js:3
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: animecharactergenerator.js:3-21, 42-46; documented usage in SKILL.md:13-23 and README.md:20-49
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

javascript
const args = process.argv.slice(2);

// Parse CLI arguments
let prompt = null;
let size = 'portrait';
let tokenFlag = null;
let refUuid = null;

for (let i = 0; i < args.length; i++) {
  if (args[i] === '--token' && args[i + 1]) {
    tokenFlag = args[++i];
  } else if (args[i] === '--size' && args[i + 1]) {
    size = args[++i];
  } else if (args[i] === '--ref' && args[i + 1]) {
    refUuid = args[++i];
  } else if (!args[i].startsWith('--') && prompt === null) {
    prompt = args[i];
  }
}

const TOKEN = tokenFlag;
javascript
const headers = {
  'x-token': TOKEN,
  'x-platform': 'nieta-app/web',
  'content-type': 'application/json',
};

The documented invocation reinforces this insecure credential-handling pattern:

bash
node animecharactergenerator.js "your prompt" --token YOUR_TOKEN

Technical Analysis

The application requires the Neta API token to be supplied through the --token command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they may be exposed through:

  • Process inspection facilities such as ps, /proc/<pid>/cmdline, or system monitoring tools.
  • Shell command history when a literal token is entered.
  • Process execution telemetry, audit logs, CI logs, or wrapper scripts.
  • Diagnostic tools that record complete command lines.

The token is subsequently placed in the x-token HTTP header and sent to the documented API endpoint. Transmission over HTTPS is expected behavior and is not itself the vulnerability; the weakness is exposing the token locally before the request i ...[truncated 1033 chars]

Remediation
View remediation

Remediation Suggestions

  • Read the token from a protected environment variable such as NETA_TOKEN instead of accepting it through --token.

  • For interactive use, support hidden input from a terminal or standard input without echoing the token.

  • If backward compatibility requires retaining --token, mark it as deprecated and clearly warn that it can expose credentials.

  • Update all examples to use a protected environment variable:

    bash
    read -rsp "Neta API token: " NETA_TOKEN
export NETA_TOKEN
node animecharactergenerator.js "your prompt"
unset NETA_TOKEN

  • Ensure application errors never print request headers or token values.

  • Recommend short-lived, narrowly scoped tokens where the provider supports them.

  • Document token rotation and immediate revocation procedures for suspected exposure.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned npx Installer and External Skill Source Create Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31-34; README.md:10-14
Vulnerability Type: Unpinned executable package and external installation source
Risk Level: Medium

Vulnerable Code

SKILL.md contains the following installation instruction:

markdown
## Install
```bash
npx skills add omactiengartelle/anime-character-generator
text

`README.md` provides the same unpinned installation path:

```markdown
## Install

**Via npx skills:**
```bash
npx skills add omactiengartelle/anime-character-generator
text

### Technical Analysis

The installation command invokes `npx skills` without specifying an exact version or integrity value. Depending on local cache and `npx` behavior, this can download and execute the current release of the `skills` package rather than a version that was reviewed.

The skill identifier `omactiengartelle/anime-character-generator` is also not pinned to an immutable commit, release, or digest. Consequently, the content installed in the future may differ from the audited project.

This is a supply-chain weakness rather than evidence that the currently reviewed files are malicious. Exploitation requires compromise, malicious replacement, or unauthorized modification of an upstream package, publisher account, repository, or distribution source.

### Attack Path

1. An attacker compromises the package or publishing account associated with the unpinned `skills` executable, or compromises the external skill source.
2. The attacker publishes a modified release or replaces mutable source content with malicious installer or skill logic.
3. A user follows the documented `npx skills add omactiengartelle/anime-character-generator` command.
4. `npx` retrieves the current, unverified package version, and the installer resolves mutable external skill content.
5. Malicious installer logic can execute during installation, or malicious skill content can be installed a
...[truncated 654 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the skills package to an exact reviewed version:

    bash
    npx --yes skills@<exact-version> add ...

  • Pin the external skill source to an immutable commit hash, signed release, or content digest if the installer supports it.

  • Publish expected checksums or signatures and require verification before installation.

  • Avoid package version ranges and mutable branch references in security-sensitive installation instructions.

  • Use a lockfile for any future runtime dependencies committed to this project.

  • Recommend installation from a trusted registry with provenance verification enabled.

  • Review publisher-account security, require multifactor authentication, and use narrowly scoped publication credentials.

  • Periodically re-audit pinned updates before changing the documented version or source digest.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes a Node script that requires an API token and interacts with an external image-generation service, which implies network access, but the manifest does not declare any tool scope or allowed-tools boundaries. This weakens containment and reviewability, making it easier for the skill to perform broader-than-expected external communication if the implementation changes or is replaced.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation guidance says to use the skill when someone asks to "generate or create anime character generator images," which is imprecise and does not clearly distinguish this skill from general anime-image or character-art requests. It lacks explicit trigger phrases, scope constraints, or negative examples, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

Using npx skills add omactiengartelle/anime-character-generator without a pinned version makes installation non-reproducible and exposes users to supply-chain risk if the upstream package, tag, or dependency graph changes maliciously or unexpectedly. An attacker who compromises the package publisher or a dependency could cause later installs to fetch altered code.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The hardcoded remote endpoint indicates this skill is designed to communicate with an external service, which constitutes intentional exfiltration of user input and credentials to a third party. While not overtly malicious, hardwiring the API destination reduces transparency and increases the chance users unknowingly send sensitive prompts or tokens to an external provider.

Content

Scanner excerpt · animecharactergenerator.js (reported line 70)May include surrounding context.

js
async function main() {
  // Submit generation job
  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The hardcoded remote endpoint indicates this skill is designed to communicate with an external service, which constitutes intentional exfiltration of user input and credentials to a third party. While not overtly malicious, hardwiring the API destination reduces transparency and increases the chance users unknowingly send sensitive prompts or tokens to an external provider.

Content

Scanner excerpt · animecharactergenerator.js (reported line 70)May include surrounding context.

js
async function main() {
  // Submit generation job
  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The polling request continues transmitting the authentication header to the external API until completion, extending token exposure duration and metadata leakage to the third-party service. This is expected for async job polling, but it is still a genuine external transmission risk because repeated authenticated requests leave the local environment and can reveal usage patterns.

Content

Scanner excerpt · animecharactergenerator.js (reported line 95)May include surrounding context.

js
for (let attempt = 0; attempt < maxAttempts; attempt++) {
    await new Promise((resolve) => setTimeout(resolve, 2000));

    const pollRes = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
      headers,
    });

Static analysis

No suspicious patterns detected.