ClawHub
Back to skill

Security audit

Concert Poster Generator

Security checks for vulnerabilities and agentic risk

Overview

This is an on-demand concert poster generator that sends prompts and a user-supplied token to an external image API, with no evidence of hidden persistence, file access, or destructive behavior.

Install only if you are comfortable sending poster prompts, optional reference image UUIDs, and your Neta token to api.talesofai.com. Prefer a scoped or disposable token, avoid confidential prompts or references, and be aware that passing the token on the command line can expose it on shared systems.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares only the Bash tool, but its documented usage depends on a Node script that calls the external Neta API using a token, which implies network access without an explicit permission declaration. This creates a transparency and policy-enforcement gap: users or hosting platforms may not realize the skill can transmit prompts and tokens to a third-party service.

Description-Behavior Mismatch

Medium
Confidence
99% confidence
Finding
The skill metadata claims it uses the Neta AI API, but the implementation actually sends the user's token, prompt, and job data to api.talesofai.com. This mismatch defeats informed consent and can route secrets and content to an unexpected third party, which is especially risky for an agent skill that users may trust based on the manifest description.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README instructs users to pass the API token via a command-line flag, which can expose the credential in shell history, terminal logs, CI logs, and process listings visible to other local users. Although this is documentation rather than executable code, it promotes an unsafe secret-handling pattern that can lead to token compromise in realistic usage.

External Transmission

Medium
Category
Data Exfiltration
Content
let createRes;
  try {
    createRes = await fetch('https://api.talesofai.com/v3/make_image', {
      method: 'POST',
      headers,
      body: JSON.stringify(body),
Confidence
90% confidence
Finding
The hardcoded external domain confirms that requests are being sent to Tales of AI rather than the stated Neta AI service. While outbound API calls are normal for this type of skill, the undeclared recipient increases privacy, trust, and credential-handling risk because the user may not realize which provider receives their data.

External Transmission

Medium
Category
Data Exfiltration
Content
let createRes;
  try {
    createRes = await fetch('https://api.talesofai.com/v3/make_image', {
      method: 'POST',
      headers,
      body: JSON.stringify(body),
Confidence
90% confidence
Finding
The hardcoded external domain confirms that requests are being sent to Tales of AI rather than the stated Neta AI service. While outbound API calls are normal for this type of skill, the undeclared recipient increases privacy, trust, and credential-handling risk because the user may not realize which provider receives their data.

External Transmission

Medium
Category
Data Exfiltration
Content
let pollRes;
    try {
      pollRes = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
        method: 'GET',
        headers,
      });
Confidence
88% confidence
Finding
The polling request repeatedly sends authenticated headers to the same undisclosed external provider, extending the exposure of the user's token beyond the initial submission. This is not inherently unsafe for a legitimate image API workflow, but it remains a real issue here because the service receiving the credential is inconsistent with the declared vendor.

Static analysis

No suspicious patterns detected.