ClawHub
Back to skill

Security audit

Pet To Human Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it calls an external image-generation API to create pet-to-human portraits, but users should understand that prompts and API tokens leave their machine.

Install only if you are comfortable using the Neta/Tales of AI service and sending it your prompt, optional reference UUID, generation settings, and API token. Prefer a narrowly scoped or temporary token, avoid placing real secrets in shell history or shared logs, and use a pinned or verified install source where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
pettohumangenerator.js:13
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis
0) args.prompt = rest.join(' '); return args; } const { prompt: promptArg, size, token: tokenFlag, ref } = parseArgs(process.argv.slice(2)); const PROMPT = promptArg || DEFAULT_PROMPT; const TOKEN = tokenFlag; ``` The documented invocation explicitly places the secret in the command line: ```bash node pettohumangenerator.js "your description here" --token YOUR_TOKEN ``` ### Technical Analysis The API token is accepted exclusively through `process.argv`. Command-line arguments are not a secure secret-transport mechanism because they may be exposed through: - Shell history files. - Process inspection utilities and operating-system process metadata, subject to local access controls. - CI/CD command logs. - Terminal session recording and observability systems. - Wrapper scripts that record invoked commands. - Debugging or crash-reporting telemetry. Although the script does not print the token itself, exposure occurs before and during script execution because the token is part of the invocation command. The token is subsequently sent as the `x-token` header to the declared API endpoint, which is expected behavior; the vulnerability concerns local handling of that credential. ### Attack Path 1. A user follows the documentation and invokes the script with `--t ...[truncated 977 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:7
Finding

Unpinned Third-Party Installer and Mutable Skill Source

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to install the skill via npx skills add omactiengartelle/pet-to-human-generator without pinning a specific version. This can cause users to fetch and execute whatever package version is current at install time, increasing supply-chain risk if the package is later compromised, replaced, or updated with malicious code. Because this is an installation command in documentation, the risk is practical: users may copy-paste it directly.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares only tools: Bash and does not explicitly constrain network-capable behavior with permissions or allowed-tools, yet its documented purpose requires calling an external API. That mismatch can allow broader-than-expected outbound access during execution, increasing the risk of unintended data exfiltration or abuse of the host environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description is heavily keyword-stuffed and broadly phrased, which can cause the agent to invoke this skill in contexts where it was not specifically requested. Overbroad triggering is risky here because the skill uses Bash and external API access, so accidental activation may expose prompts, tokens, or user data to a third-party service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The When to use guidance says to use the skill whenever someone asks to generate pet-to-human images, which is too broad and does not require informed consent for external API use or token handling. In this context, ambiguous activation increases the chance of unintentional third-party data transfer and unnecessary execution of Bash-based tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

Using npx skills add omactiengartelle/pet-to-human-generator without a pinned version creates a supply-chain risk because future installs may resolve to modified or compromised content. An attacker controlling the package or an upstream dependency could cause users to install unexpected code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script requires a user-supplied API token and automatically sends it in an HTTP header to a third-party service, but it does not clearly warn the user that their credential and prompt data will be transmitted off-host. In a skill context, this matters because users may run it assuming local-only processing, and the token could be exposed to an untrusted service or logged/monitored externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This code sends user-controlled prompt content, optional reference IDs, image generation parameters, and the API token to an external domain. External transmission is expected for an API client, but in an agent skill this is still security-relevant because potentially sensitive inputs are exfiltrated to a remote service without any validation, minimization, or explicit consent flow.

Content

Scanner excerpt · pettohumangenerator.js (reported line 64)May include surrounding context.

js
body.inherit_params = { collection_uuid: ref, picture_uuid: ref };
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This code sends user-controlled prompt content, optional reference IDs, image generation parameters, and the API token to an external domain. External transmission is expected for an API client, but in an agent skill this is still security-relevant because potentially sensitive inputs are exfiltrated to a remote service without any validation, minimization, or explicit consent flow.

Content

Scanner excerpt · pettohumangenerator.js (reported line 64)May include surrounding context.

js
body.inherit_params = { collection_uuid: ref, picture_uuid: ref };
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The polling request repeatedly sends the same authentication header to the external service for up to 90 attempts, extending exposure of the token and creating sustained outbound communication. While this is normal API-client behavior, in a skill setting it increases the amount of credential-bearing traffic and continues sharing task metadata with a third party.

Content

Scanner excerpt · pettohumangenerator.js (reported line 86)May include surrounding context.

js
}

async function pollTask(taskUuid) {
  const url = `https://api.talesofai.com/v1/artifact/task/${taskUuid}`;
  for (let attempt = 0; attempt < 90; attempt++) {
    await new Promise((r) => setTimeout(r, 2000));
    const res = await fetch(url, { headers: HEADERS });

Static analysis

No suspicious patterns detected.