ClawHub
Back to skill

Security audit

Liminal Space Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says, but users should handle the Neta API token carefully and understand that prompts are sent to an external image API.

Install only from a source you trust, avoid running the install command with elevated privileges, and prefer a safer token-handling workflow than pasting a live API token into command arguments or shared logs. Expect your prompt and optional reference UUID to be sent to the Neta/Tales of AI image service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Remote Packages and Repository Content Used During Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
liminalspacegenerator.js:20
Finding

API Token Accepted Through Process Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README repeatedly instructs users to pass the API token via --token on the command line, which can expose secrets through shell history, process listings, audit logs, or CI job output. This is more concerning in this skill because the token is required for every invocation, increasing the likelihood that users will normalize unsafe secret-handling practices and leak a live API credential.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares only tools: Bash while its documented behavior clearly requires outbound network access to the Neta API, but it does not define any explicit tool scope or network restrictions. This increases the blast radius of shell execution because the agent may invoke network-capable code without transparent boundaries, making misuse, unexpected exfiltration, or overbroad execution harder to control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to pass an API token directly via the --token command-line flag but provides no warning that command-line arguments may be exposed through shell history, process listings, logs, or transcripts. In the context of an agent skill that uses Bash, this materially increases the likelihood of credential leakage and downstream unauthorized API use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger guidance says to use the skill when someone asks to generate liminal space images, but it does not define exclusions, approval boundaries, or limits on when shell/networked execution should occur. In an agent setting, vague invocation criteria can cause over-triggering, leading the agent to send prompts or tokens to external services when the user did not clearly intend that behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The installation command uses npx skills without pinning a version, which makes the environment depend on whatever package version is current at install time. This creates a supply-chain risk: a compromised, malicious, or simply breaking future release could execute unintended code during installation or alter behavior after publication.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The hardcoded remote endpoint confirms that data is transmitted off-host to a third-party service. In the context of an agent skill, this matters because users may not realize their prompts, reference IDs, and bearer-style token are leaving the local environment and being processed by an external provider.

Content

Scanner excerpt · liminalspacegenerator.js (reported line 63)May include surrounding context.

js
console.error(`→ Generating: "${prompt}"`);
  console.error(`  Size: ${size} (${dims.width}×${dims.height})`);

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The hardcoded remote endpoint confirms that data is transmitted off-host to a third-party service. In the context of an agent skill, this matters because users may not realize their prompts, reference IDs, and bearer-style token are leaving the local environment and being processed by an external provider.

Content

Scanner excerpt · liminalspacegenerator.js (reported line 63)May include surrounding context.

js
console.error(`→ Generating: "${prompt}"`);
  console.error(`  Size: ${size} (${dims.width}×${dims.height})`);

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · liminalspacegenerator.js (reported line 93)May include surrounding context.

js
for (let attempt = 0; attempt < 90; attempt++) {
    await new Promise((r) => setTimeout(r, 2000));
    const pollRes = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
      headers,
    });
    if (!pollRes.ok) continue;

Static analysis

No suspicious patterns detected.