ClawHub
Back to skill

Security audit

Dark Fantasy Art Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a simple image-generation skill with disclosed external API use, but users should review the unpinned installer and API token handling.

Before installing, prefer the ClawHub path or verify and pin the npx installer package. Treat prompts, reference IDs, and the API token as data sent to the external Neta/api.talesofai.com service, and avoid placing long-lived tokens directly on the command line when a safer credential method is available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31-34 and README.md:9-13
Vulnerability Type: Supply-chain risk caused by unpinned package execution
Risk Level: Medium

Vulnerable Code

SKILL.md:31-34:

bash
## Install
```bash
npx skills add omactiengartelle/dark-fantasy-art-generator
text

`README.md:9-13`:

```bash
## Install

```bash
npx skills add omactiengartelle/dark-fantasy-art-generator
text

### Technical Analysis

The recommended installation command invokes the npm package named `skills` through `npx` without specifying a reviewed version or integrity hash. If the package is not already installed locally, `npx` can retrieve its currently published release and execute its entry point.

Consequently, the effective installation code can change after this project has been reviewed. Compromise of the package publisher, npm account, package distribution channel, or a future malicious release could cause users following the documented instructions to execute unreviewed code.

The repository's `package.json` does not declare the `skills` package as a pinned dependency, and no lockfile or integrity information is present to constrain the resolved artifact.

### Attack Path

1. An attacker compromises the npm package, its publisher account, or the relevant package publication workflow.
2. The attacker publishes a malicious release under the package name resolved by `npx skills`.
3. A user follows the documented installation command.
4. `npx` downloads the current package release because no version is pinned.
5. The downloaded package executes with the privileges of the user running the command.
6. Malicious package code can access resources available to that user.

### Impact Assessment

Successful exploitation permits arbitrary code execution with the invoking user's privileges. Depending on the local environment, the malicious package could read accessible files and 
...[truncated 295 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the installer package to a specific, reviewed version, for example by using the verified package name with an explicit version suffix.
  • Use a lockfile and package-manager integrity metadata where the installation workflow permits it.
  • Verify and document the expected package publisher and source repository.
  • Review the pinned package version before recommending it to users.
  • Prefer an installation mechanism that does not automatically execute newly downloaded third-party code.
  • If npx remains necessary, advise users to reject unexpected package installation prompts and verify the resolved package and version before execution.
  • Update both SKILL.md and README.md so every documented installation path applies the same controls.

T09 · Insecure Skill Coding Practices

Note
Location
darkfantasyartgenerator.js:15
Finding

API Token Exposed Through Process Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: darkfantasyartgenerator.js:15-25; usage is documented in SKILL.md:13-19 and README.md:58-67
Vulnerability Type: Sensitive credential passed through command-line arguments
Risk Level: Low

Vulnerable Code

darkfantasyartgenerator.js:15-25:

javascript
function parseArgs(argv) {
  const args = { size: 'portrait', token: null, ref: null, prompt: null };
  const positional = [];
  for (let i = 0; i < argv.length; i++) {
    const a = argv[i];
    if (a === '--size') args.size = argv[++i];
    else if (a === '--token') args.token = argv[++i];
    else if (a === '--ref') args.ref = argv[++i];
    else positional.push(a);
  }
  if (positional.length > 0) args.prompt = positional.join(' ');
  return args;
}

SKILL.md:13-19:

bash
## Token

Requires a Neta API token (free trial at https://www.neta.art/open/). Pass it via the `--token` flag.

```bash
node <script> "your prompt" --token YOUR_TOKEN
text

`README.md:58-67`:

```bash
## Token Setup

This skill requires a Neta API token. Pass it via the `--token` flag:

```bash
node darkfantasyartgenerator.js "your prompt" --token YOUR_TOKEN

You can also use shell expansion to keep the token out of your command history:

bash
node darkfantasyartgenerator.js "your prompt" --token "$NETA_TOKEN"
text

### Technical Analysis

The program requires the API token to be supplied as the value of the `--token` process argument. Command-line arguments may be visible to local process-inspection facilities, diagnostic collectors, process monitors, audit systems, crash tooling, or other users where operating-system process isolation permits such access.

Expanding `$NETA_TOKEN` in the shell can prevent the literal secret from being saved in command history, but it does not prevent exposure through the resulting process argument vector. After expansion, th
...[truncated 1298 chars]
Remediation
View remediation

Remediation Suggestions

  • Read the token from a protected environment variable such as NETA_TOKEN without copying it into the command-line arguments.
  • For stronger protection against process-environment inspection, support reading the token from standard input or a securely permissioned credential file.
  • If interactive use is supported, prompt for the token without terminal echo.
  • Retain --token only as an explicitly documented compatibility option and warn that it can expose the token through process listings and telemetry.
  • Ensure errors and diagnostics never print request headers or token values.
  • Review process-monitoring and logging systems to ensure command-line arguments are redacted.
  • Update SKILL.md and README.md so the secure credential-input mechanism is the primary documented method.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The README instructs users to install the skill via npx skills add ... without pinning a specific version or immutable reference. This can cause users to fetch whatever package/version is current at execution time, creating a supply-chain risk if the package is later compromised, replaced, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares Bash usage and explicitly instructs users to call an external API with a token, but it does not define any tool scope such as permissions or allowed-tools. That leaves network-capable execution insufficiently bounded, increasing the chance the skill could make unintended outbound requests or misuse secrets in environments that rely on manifest scoping for enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The phrase "Use when someone asks to generate or create dark fantasy art generator images" is ambiguous and poorly scoped: it does not provide specific trigger examples, exclusions, or clear boundaries for activation. This can cause unintended invocation because it loosely overlaps with general requests for image generation without defining when this specific skill is appropriate versus other art-generation skills.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The install instruction uses npx skills without pinning a version, which can cause users to execute whatever package version is current at install time. If the upstream package is compromised or a breaking/malicious update is published, consumers may run unreviewed code during installation or skill management.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The hardcoded https://api.talesofai.com endpoint indicates outbound data transfer to a third party. While HTTPS protects transport, the risk is that users are led to believe they are interacting with Neta AI, so prompts and tokens may be sent to an undisclosed service contrary to expectations.

Content

Scanner excerpt · darkfantasyartgenerator.js (reported line 66)May include surrounding context.

js
body.inherit_params = { collection_uuid: ref, picture_uuid: ref };
  }

  const createRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The hardcoded https://api.talesofai.com endpoint indicates outbound data transfer to a third party. While HTTPS protects transport, the risk is that users are led to believe they are interacting with Neta AI, so prompts and tokens may be sent to an undisclosed service contrary to expectations.

Content

Scanner excerpt · darkfantasyartgenerator.js (reported line 66)May include surrounding context.

js
body.inherit_params = { collection_uuid: ref, picture_uuid: ref };
  }

  const createRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata claims it uses the Neta AI API, but the implementation sends the user's prompt and token to api.talesofai.com instead. This mismatch is dangerous because users may disclose credentials or sensitive prompts under false assumptions about the recipient service, undermining informed consent and trust boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The polling request continues sending authenticated requests to the same external Tales of AI service to retrieve task results. By itself this is normal asynchronous API behavior, but in the context of the provider mismatch it reinforces ongoing undisclosed communication with a third party.

Content

Scanner excerpt · darkfantasyartgenerator.js (reported line 96)May include surrounding context.

js
for (let attempt = 0; attempt < 90; attempt++) {
    await sleep(2000);
    const pollRes = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
      method: 'GET',
      headers,
    });

Static analysis

No suspicious patterns detected.