ClawHub
Back to skill

Security audit

Dark Academia Art Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do its stated image-generation job, but it handles the user's API token in an avoidably exposed way and gives an unpinned install command.

Review before installing. Prefer a trusted or pinned install path, do not run the installer with elevated privileges, and treat prompts, reference IDs, and the Neta token as data sent to the external image API. Use a short-lived or revocable token if possible, because the current examples place the token on the command line.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
darkacademiaartgenerator.js:17
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: darkacademiaartgenerator.js:17-23, 96-101; SKILL.md:17-24; README.md:17-19, 61-65
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

The documented and implemented authentication mechanism requires users to supply the Neta API token through the --token command-line argument.

javascript
} else if (a === '--token') {
  tokenFlag = args[++i];
} else if (a === '--ref') {
  ref = args[++i];
} else if (!a.startsWith('--') && prompt === null) {
  prompt = a;
}

The token is subsequently retrieved from the parsed command-line arguments:

javascript
const args = parseArgs(argv.slice(2));
const PROMPT = args.prompt || DEFAULT_PROMPT;
const TOKEN = args.tokenFlag;

if (!TOKEN) {
  console.error('\n✗ Token required. Pass via: --token YOUR_TOKEN');
  console.error('  Get yours at: https://www.neta.art/open/');

The documentation explicitly instructs users to place the secret on the command line:

bash
node darkacademiaartgenerator.js "your description here" --token YOUR_TOKEN

Technical Analysis

Command-line arguments are not a suitable secret transport mechanism. Depending on the operating system and runtime environment, process arguments may be exposed through process inspection interfaces, monitoring agents, audit logs, command telemetry, diagnostic reports, or container orchestration metadata. The command may also be retained in the user's shell history.

An attacker does not need to compromise the remote image-generation service. A local user, administrative monitoring component, or other process with permission to inspect the invocation can capture the token while the command is running or recover it later from shell history.

The token is legitimately required for the declared image-generation functionality, and transmitting it to the image-generation AP ...[truncated 1133 chars]

Remediation
View remediation

Remediation Suggestions

  • Support a protected environment variable such as NETA_API_TOKEN instead of requiring a command-line argument.

  • Prefer secret input through standard input or a hidden interactive prompt when practical.

  • If backward compatibility requires --token, mark it as deprecated and clearly warn that process arguments and shell history may expose it.

  • Update all examples to avoid placing literal credentials in commands, for example:

    bash
    export NETA_API_TOKEN="..."
node darkacademiaartgenerator.js "your description here"

  • Ensure errors and diagnostic output never print the token.

  • Recommend short-lived, narrowly scoped tokens where supported and provide token-revocation guidance.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:30-33; README.md:6-10
Vulnerability Type: Unpinned executable dependency and supply-chain exposure
Risk Level: Medium

The installation instructions direct users to invoke an unpinned package through npx:

bash
npx skills add omactiengartelle/dark-academia-art-generator

Technical Analysis

When the requested command is not already available locally, npx can resolve, download, and execute a package from the configured npm registry. The command does not specify a reviewed version of the skills package. The project also provides no lockfile, package integrity hash, or verification procedure for this installer.

Consequently, the code executed during installation can differ from the code that was reviewed. A compromised package release, malicious ownership transfer, registry compromise, or unsafe future release could introduce arbitrary installer behavior.

The audited project itself contains no npm lifecycle hooks or runtime dependencies in package.json. The risk arises from the external installation command rather than from an embedded dependency in the package.

Attack Path

  1. An attacker compromises the publishing account or distribution path for the skills package, or publishes a malicious future release.
  2. A user follows the documented unversioned npx skills add ... command.
  3. npx resolves and downloads the current package version rather than a specifically reviewed version.
  4. The downloaded package executes with the permissions of the invoking user.
  5. Malicious installer code can access or modify resources available to that user.

This path is contingent on compromise or malicious modification of the external package; the reviewed repository does not itself contain such a payload.

Impact Assessment

A compromised installer could execute arbitrary code with the invoking user's privileges. Depending on those privileges ...[truncated 380 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the installer to a specifically reviewed version, for example npx skills@X.Y.Z ....
  • Verify and document the expected package publisher and registry.
  • Use lockfiles or integrity hashes where the installation workflow supports them.
  • Prefer a trusted, preinstalled installer rather than downloading executable code at invocation time.
  • Advise users not to run the installation command with administrative or root privileges.
  • Periodically review pinned installer updates before changing the documented version.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The README instructs users to install the skill via npx skills add without pinning a specific version or immutable reference. That can cause users to fetch and execute whatever package/version is current at install time, creating a supply-chain risk if the upstream package is updated maliciously, compromised, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation instruction uses npx skills add omactiengartelle/dark-academia-art-generator without a pinned version, so users may fetch whatever package/version is current at execution time. That creates a supply-chain risk: if the package is updated maliciously, compromised, or replaced upstream, users could install and run unexpected code.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · darkacademiaartgenerator.js (reported line 50)May include surrounding context.

js
body.inherit_params = { collection_uuid: ref, picture_uuid: ref };
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: {
      'x-token': token,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · darkacademiaartgenerator.js (reported line 50)May include surrounding context.

js
body.inherit_params = { collection_uuid: ref, picture_uuid: ref };
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: {
      'x-token': token,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · darkacademiaartgenerator.js (reported line 82)May include surrounding context.

js
body.inherit_params = { collection_uuid: ref, picture_uuid: ref };
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: {
      'x-token': token,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code sends the user's prompt content to an external image-generation API and includes an authentication token in request headers, but there is no confirmation prompt or explicit user-facing notice that prompt data will be transmitted off-system. For code files, outbound transmission of user or system data should have some visible disclosure unless it is clearly warned elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.