ClawHub
Back to skill

Security audit

Film Photo Generator

Security checks for vulnerabilities and agentic risk

Overview

This image generator appears purpose-aligned, but it under-discloses external data sharing and handles the API token in a risky way.

Review this skill before installing. Only use it with prompts and reference IDs you are comfortable sending to the Neta/TalesOfAI service, avoid putting real tokens directly in shell commands on shared or logged systems, and prefer a pinned or ClawHub-managed install path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:9
Finding

Unpinned Third-Party Package Executed During Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
filmphotogenerator.js:11
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README clearly directs users to send free-form prompts and optional reference image identifiers to an external image-generation API, but it does not warn users that this data leaves the local environment and may be logged, retained, or processed by a third party. In this skill context, prompts and reference IDs may contain sensitive personal, proprietary, or identifying information, so the lack of a privacy/data-sharing notice increases the risk of inadvertent disclosure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx skills add without pinning a specific version, which allows whatever package/version is current at execution time to be fetched and run. If the upstream package, dependency chain, or registry entry is compromised, users could execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares only tools: Bash and does not explicitly scope or disclose network permissions, yet the documented usage sends prompts and an API token to the external Neta service. This creates a mismatch between apparent and actual capabilities, which can mislead users and reviewers about data egress and increase the chance of unintended external transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown instructs users to pass prompts and an API token to a third-party image generation service but does not provide an explicit warning that user data will be transmitted externally. This can lead users to unknowingly share sensitive prompts, images, or credentials with a third party, especially because the skill is framed as a simple generation utility.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The 'When to use' guidance says to use the skill when someone asks to 'generate or create ai film photo generator images,' which is ambiguous and not a clearly bounded trigger condition. It does not provide specific invocation examples, constraints, or negative examples to distinguish this skill from general image-generation requests.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Using npx skills add omactiengartelle/film-photo-generator without pinning a version allows the installed package or referenced content to change over time. This weakens supply-chain integrity and can expose users to malicious or compromised updates without any change to the invocation in the documentation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill’s help text and branding direct users to obtain a token from Neta AI, but the implementation actually sends that token and user prompts to TalesOfAI endpoints. This mismatch is dangerous because it can mislead users into disclosing credentials to an unintended third party and defeats informed consent about where data is sent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The hardcoded TalesOfAI domain indicates outbound network transmission to a third-party service. In isolation this is normal for API-backed tooling, but in this skill it becomes problematic because the service identity conflicts with the stated Neta AI branding, making the transmission deceptive from a user trust perspective.

Content

Scanner excerpt · filmphotogenerator.js (reported line 70)May include surrounding context.

js
};
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The hardcoded TalesOfAI domain indicates outbound network transmission to a third-party service. In isolation this is normal for API-backed tooling, but in this skill it becomes problematic because the service identity conflicts with the stated Neta AI branding, making the transmission deceptive from a user trust perspective.

Content

Scanner excerpt · filmphotogenerator.js (reported line 70)May include surrounding context.

js
};
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest/description claim the skill uses the Neta AI image generation API, but the code posts data to TalesOfAI and polls a TalesOfAI task endpoint. This is a supply-chain trust and transparency issue: users and reviewers may approve the skill based on one vendor while their prompts and token are actually transmitted to another service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The polling request continuously sends authenticated requests to the external TalesOfAI task endpoint until completion. While functionally necessary, it extends the external interaction surface and reinforces that sensitive workflow metadata is being shared with an undisclosed provider relative to the skill description.

Content

Scanner excerpt · filmphotogenerator.js (reported line 97)May include surrounding context.

js
const maxAttempts = 90;
  for (let i = 0; i < maxAttempts; i++) {
    await new Promise((r) => setTimeout(r, 2000));
    const res = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
      headers: HEADERS,
    });
    if (!res.ok) continue;

Static analysis

No suspicious patterns detected.