Plush Toy Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.0

Overview

This plush-toy image skill mostly does what it claims, but it needs Review because its loaded skill instructions under-disclose the actual API host while asking users to pass an API token on the command line.

Review before installing. This skill sends your prompt and API token to an external image service; confirm that api.talesofai.com is the provider you intend to trust. Avoid placing real tokens directly on the command line, and prefer a pinned or ClawHub-managed install path over unpinned npx.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: plushtoygenerator.js:22

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: plushtoygenerator.js:22-24, 36-45; documented usage in SKILL.md:15-19 and README.md:61-67
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

javascript

function parseArgs(args) {
  const out = { positional: [], size: 'square', token: null, ref: null };
  for (let i = 0; i < args.length; i++) {
    const a = args[i];
    if (a === '--size') { out.size = args[++i]; }
    else if (a === '--token') { out.token = args[++i]; }
    else if (a === '--ref') { out.ref = args[++i]; }
    else { out.positional.push(a); }
  }
  return out;
}

javascript

const tokenFlag = args.token;
const TOKEN = tokenFlag;

if (!TOKEN) {
  console.error('\n✗ Token required. Pass via: --token YOUR_TOKEN');
  console.error('  Get yours at: https://www.neta.art/open/');
  exit(1);
}

The documented invocation reinforces this insecure credential-handling pattern:

bash

node plushtoygenerator.js "your description here" --token YOUR_TOKEN

Technical Analysis

The application requires the Neta API token to be passed as a command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they can be retained in shell history, captured by command auditing or telemetry, and exposed through process-inspection facilities while the application is running.

The token is subsequently used as the x-token authentication header for requests to https://api.talesofai.com. Therefore, disclosure of the argument can reveal a reusable API credential rather than merely non-sensitive configuration data.

Exploitation requires access to the user's shell history, local process information, command logs, or another system that records command invocations. The code does not intentionally print the token, and no remote credential exfiltration beyond transmission to ...[truncated 968 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer a protected environment variable, such as NETA_API_TOKEN, rather than a command-line argument.
• For interactive use, support reading the token from a non-echoing prompt or standard input.
• For automated deployments, integrate with an operating-system credential store or CI secret manager.
• Remove examples that place real secrets directly on the command line.
• If backward compatibility requires retaining --token, mark it as deprecated and clearly warn that command-line values may be visible in process listings and shell history.
• Ensure application errors, debug output, and telemetry never serialize request headers or the parsed token.
• Advise users who previously followed the documented pattern to remove affected shell-history entries and rotate potentially exposed tokens.

T08 · Insecure Dependencies

Warning

• Location: README.md:8

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md:8-12; equivalent instruction in SKILL.md:32-34
Vulnerability Type: Unpinned executable dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

bash

npx skills add omactiengartelle/plush-toy-generator

The same installation command appears in SKILL.md:

bash

npx skills add omactiengartelle/plush-toy-generator

Technical Analysis

The installation instructions invoke npx skills without specifying an audited package version or integrity hash. If the package is unavailable locally, npx can retrieve and execute the package resolved from the configured registry. The effective installer code is therefore mutable and is not part of the audited project.

This creates a supply-chain trust boundary: a compromise of the registry account, package namespace, registry configuration, or a future malicious release could change the code executed by users while the repository's reviewed files remain unchanged. The audit found no evidence that the current skills package is malicious; the risk is the unsafe, unpinned execution pattern.

Attack Path

1. An attacker compromises the publishing account or distribution channel for the package resolved as skills, or causes the user to resolve it from a malicious registry.
2. The attacker publishes a modified package version containing malicious installation or runtime code.
3. A user follows the project documentation and runs the unpinned npx skills add ... command.
4. npx downloads the attacker-controlled package version and executes it with the invoking user's privileges.
5. The malicious package can access or modify resources available to that user, subject to operating-system and sandbox restrictions.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running the installation command. The resulting scope may include ...[truncated 256 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer to a specifically reviewed version, for example by using an exact package version rather than the latest registry resolution.
• Verify and document the expected package registry and package publisher.
• Use lockfiles and integrity metadata where the installation workflow supports them.
• Prefer a reproducible installation process that does not execute mutable remote package content implicitly.
• Provide a manual installation option that allows users to inspect downloaded files before execution.
• Regularly audit the pinned installer version and update it only after review.
• Consider publishing checksums or signed release artifacts and documenting signature verification.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose says the skill uses the Neta AI API, but the analyzed behavior indicates it actually calls different remote endpoints and supports additional reference/inheritance functionality not transparently disclosed. This mismatch is dangerous because users and reviewers cannot accurately assess where tokens, prompts, and images are sent, enabling covert data exfiltration, consent bypass, or unexpected processing by an undisclosed third party.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to supply the API token on the command line, which can leak credentials through shell history, process listings, audit logs, and CI job output. Because this skill directly depends on a bearer token for a third-party API, the usage guidance increases the chance of accidental credential exposure in normal operation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares Bash tooling but does not constrain tool scope with explicit permissions or allowed-tools, even though its documented behavior involves network access to a remote API. In agent environments, missing scope declarations can let the skill run with broader capabilities than users expect, increasing the chance of unintended outbound requests or abuse if the skill is invoked in a different runtime context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "Use when someone asks to generate or create plush toy plushie stuffed animal generator images" is broad, ungrammatical, and lacks clear trigger boundaries or exclusions. It does not provide specific invocation phrases or negative examples, increasing the risk of unintended activation for ordinary image-generation requests.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The install instruction uses npx skills without a pinned version, which makes installation depend on whatever package version is current at execution time. This creates a supply-chain risk: a compromised, malicious, or simply breaking upstream release could alter the behavior of the installed tooling without any change to this skill repository.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The hardcoded HTTPS endpoint indicates outbound network access to a third-party service. In isolation this is normal functionality, but in this skill it increases risk because the endpoint belongs to TalesOfAI while the skill presents itself as using Neta AI, which can mislead users about where their data is going.

Content

Scanner excerpt · plushtoygenerator.js (reported line 75)May include surrounding context.

js

console.error('→ Submitting plush toy generation request...');

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The hardcoded HTTPS endpoint indicates outbound network access to a third-party service. In isolation this is normal functionality, but in this skill it increases risk because the endpoint belongs to TalesOfAI while the skill presents itself as using Neta AI, which can mislead users about where their data is going.

Content

Scanner excerpt · plushtoygenerator.js (reported line 75)May include surrounding context.

js

console.error('→ Submitting plush toy generation request...');

  const submitRes = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers,
    body: JSON.stringify(body),

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata claims it uses the Neta AI API, but the implementation sends user prompts and API tokens to TalesOfAI endpoints instead. This is dangerous because users may provide credentials and content under false assumptions about the receiving service, creating a trust-boundary violation and possible unauthorized disclosure of secrets and user data to an unexpected third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The polling request continues transmitting the provided authentication header to the external TalesOfAI service after submission. Polling itself is standard for async jobs, but it prolongs credential use and maintains communication with an undisclosed provider, compounding the transparency and data-handling issue.

Content

Scanner excerpt · plushtoygenerator.js (reported line 109)May include surrounding context.

js

for (let attempt = 0; attempt < 90; attempt++) {
    await new Promise((r) => setTimeout(r, 2000));

    const pollRes = await fetch(`https://api.talesofai.com/v1/artifact/task/${taskUuid}`, {
      method: 'GET',
      headers,
    });

Static analysis

No suspicious patterns detected.