ClawHub
Back to skill

Security audit

Dnd Character Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward D&D character image generator that uses an external API, with supply-chain and privacy notes users should understand before installing.

Before installing, confirm that your Neta token is meant to be used with `api.talesofai.com`, avoid sending sensitive prompts or private reference IDs, and prefer a pinned or ClawHub-managed install path over the unpinned `npx` command when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:32 and README.md:10
Vulnerability Type: Unpinned package execution and software supply-chain risk
Risk Level: Medium

The installation documentation instructs users to retrieve and execute the skills package through npx without specifying a reviewed version or integrity constraint.

Complete vulnerable code snippet from SKILL.md:30-33:

bash
## Install
```bash
npx skills add omactiengartelle/dnd-character-skill
text

**Equivalent vulnerable code snippet from `README.md:8-12`:**
```bash
## Install

```bash
npx skills add omactiengartelle/dnd-character-skill
text

### Technical Analysis

When a requested package is not already available locally, `npx` can retrieve it from the configured npm registry and execute its CLI or associated package code. The command uses the generic package name `skills` without a version pin, lockfile, or integrity hash.

Consequently, the code executed during installation is not immutable relative to the reviewed repository. A future compromised, malicious, or unexpectedly modified release of `skills` could execute different behavior when a user follows these instructions. This is a supply-chain trust issue rather than evidence that the currently published package is malicious.

The alternative `clawhub install dnd-character-skill` command documented in `README.md` was not shown to have the same `npx` execution behavior and is not included in this finding.

### Attack Path

1. An attacker compromises the publishing account, registry entry, or release process associated with the unpinned `skills` package, or otherwise causes a malicious version to be resolved from the user's configured registry.
2. The attacker publishes a release containing malicious CLI or lifecycle behavior.
3. A user follows the documented command:
   ```bash
   npx skills add omactiengartelle/dnd-character-skill
   ```
4. `np
...[truncated 1316 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to a specifically reviewed version:
    bash
    npx --yes skills@<reviewed-version> add omactiengartelle/dnd-character-skill
  2. Verify that the selected package name and publisher are authoritative and resistant to dependency-confusion or typosquatting attacks.
  3. Record and verify the expected package integrity digest where the installation workflow supports integrity enforcement.
  4. Prefer installing the reviewed dependency through a lockfile-backed project workflow rather than dynamically retrieving the latest release during installation.
  5. Use a trusted internal registry or approved package mirror in controlled and CI environments.
  6. Run installation with least privilege. Do not use sudo, an administrator account, or unnecessary secrets in the process environment.
  7. Apply the same hardened command consistently in both SKILL.md and README.md.
  8. Periodically review the pinned release before deliberately upgrading it.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README encourages users to submit character descriptions and optional reference-image IDs to an external image-generation API but does not clearly warn that this data leaves the local environment and is processed by a third party. This can lead users to unknowingly send sensitive prompts, proprietary campaign material, or identifying reference data to an external service, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes a Node script that calls an external image-generation API and therefore requires network access, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege gap: an agent or runtime may grant broader execution/network capability than users expect, increasing the risk of unintended external requests or misuse if the skill or its dependencies are modified.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The install instruction uses npx skills add omactiengartelle/dnd-character-skill without pinning a specific version or immutable reference. This exposes consumers to supply-chain risk because future upstream changes, account compromise, or a malicious republish could cause different code to be installed than what was originally reviewed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The inline help text instructs users to obtain a token from Neta, while the code uses that token in requests to Tales of AI. This can trick users into supplying credentials under false pretenses and sending them to an unrelated service, which is a credential-handling and transparency failure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dndcharacter.js (reported line 66)May include surrounding context.

js
};
  }

  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dndcharacter.js (reported line 66)May include surrounding context.

js
};
  }

  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dndcharacter.js (reported line 98)May include surrounding context.

js
};
  }

  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill metadata and description claim it uses Neta AI, but the code actually sends prompts and authentication tokens to Tales of AI endpoints. This mismatch is dangerous because it defeats informed user consent and can misdirect secrets and user content to an unexpected third party, a strong indicator of deceptive behavior rather than a simple implementation mistake.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code transmits the user prompt and token to a remote API without any explicit user-facing disclosure inside the skill at the point of use. In this skill context, prompts may contain original creative content and the token is a secret, so silent transmission increases privacy and credential exposure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.