Tattoo Design Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a real tattoo image generator, but its unpinned npx install path and command-line API token handling deserve review before installation.

Review this skill before installing. Prefer the ClawHub install path or a pinned, trusted installer rather than the unpinned npx command. Do not pass sensitive or regulated prompts, and avoid placing a real API token directly in shell history or shared logs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-34
Additional Location: README.md:11-14
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

The installation instructions execute the skills package through npx without specifying a reviewed version or integrity constraint:

markdown

## Install
```bash
npx skills add omactiengartelle/tattoo-design-generator

text

The same command appears in `README.md`:

```markdown
**Via npx skills:**
```bash
npx skills add omactiengartelle/tattoo-design-generator

text

### Technical Analysis

When no package version is specified, `npx` may resolve, download, and execute the package version currently supplied by the configured package registry. The project does not include a lockfile, checksum, integrity value, or other mechanism that constrains the executable package resolved by this command.

Consequently, the actual code executed during installation can change after this skill has been reviewed. Exploitation would require compromise of the relevant registry package, maintainer account, package resolution process, or another component in the software supply chain. There is no evidence in the audited project that the current package is malicious; the risk arises from executing a mutable, unverified dependency.

### Attack Path

1. An attacker compromises the package publisher account, registry package, or another relevant part of the package distribution chain.
2. The attacker publishes a malicious version that is selected when `npx skills` is resolved without a version constraint.
3. A user follows the documented installation command.
4. `npx` downloads and executes the attacker-controlled release.
5. The malicious package runs with the privileges and filesystem or network access of the user performing the installation.

### Impact Assessment

Successful exploitation could permit arbitrary code execution un
...[truncated 445 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin skills to a specifically reviewed version:

   bash

   npx skills@<reviewed-version> add omactiengartelle/tattoo-design-generator
   

2. Document the expected package registry and avoid silently relying on user-specific registry configuration.
3. Where supported, enforce a lockfile or package integrity hash.
4. Review the pinned package and its transitive dependencies before recommending execution.
5. Update both SKILL.md and README.md so all installation paths use the same constrained version.
6. Consider installing the reviewed dependency separately and invoking its local binary rather than allowing npx to fetch and immediately execute an unconstrained release.

T09 · Insecure Skill Coding Practices

Warning

• Location: tattoodesigngenerator.js:9

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: tattoodesigngenerator.js:9-11, 25
Documentation Locations: SKILL.md:15-19, README.md:24-28
Vulnerability Type: Insecure secret handling
Risk Level: Medium

The script obtains the API token directly from the process command line:

javascript

if (args[i] === '--token' && args[i + 1]) {
  tokenFlag = args[++i];
}

It then assigns that command-line value as the credential used by the application:

javascript

const TOKEN = tokenFlag;

The documented invocation explicitly encourages placing the secret in the command line:

bash

node <script> "your prompt" --token YOUR_TOKEN

Technical Analysis

Command-line arguments are not an appropriate primary transport for secrets. Depending on the operating system, process configuration, shell, automation platform, and logging environment, command arguments may be exposed through:

• Shell history files
• Process inspection utilities
• Process accounting or endpoint-monitoring systems
• CI/CD command logs
• Wrapper scripts and task-runner logs
• Diagnostic or crash reports

Quoting the token or expanding it from an environment variable in the shell does not necessarily solve the process-list exposure because the expanded value may still become part of the child process's argument vector.

The application does not intentionally print the token, and the reviewed code transmits it only to the documented API host in the x-token header. The vulnerability is therefore limited to the token's insecure local handling as a command-line argument, rather than a confirmed remote exfiltration mechanism.

Attack Path

1. A user follows the documentation and invokes the script with --token YOUR_TOKEN.
2. The token is stored in shell history, captured by execution logging, or exposed in the process argument list while the script is running.
3. A local user, monitoring agent ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the token from a protected environment variable by default:

   javascript

   const TOKEN = process.env.NETA_TOKEN;
   

2. Update usage documentation accordingly:

   bash

   NETA_TOKEN="$NETA_TOKEN" node tattoodesigngenerator.js "your prompt"
   

   For interactive use, prefer exporting the variable from a secure credential manager rather than typing the secret directly into a history-recorded command.
3. For interactive workflows, support reading the token from a masked prompt or standard input.
4. If --token must remain for compatibility, mark it as deprecated and display a warning explaining that command-line arguments may be observable.
5. Ensure application errors and debug logs never serialize request headers, the environment, or the token.
6. Recommend narrowly scoped, short-lived API tokens where the service supports them, and document immediate token revocation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explains prompt and --ref usage but does not clearly warn that user prompts and reference identifiers are transmitted to an external third-party API. This can lead users to submit sensitive creative concepts, private identifiers, or proprietary material without informed consent or awareness of third-party processing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The README instructs users to install and run tooling via npx skills without pinning a specific version. This creates a supply-chain risk because users may fetch and execute whatever package version is current at install time, including a compromised or malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares Bash usage and instructs users to run a Node script that requires an API token, but it does not declare any explicit tool scope or permissions despite behavior that clearly implies outbound network access. Missing scope declarations weaken reviewability and enforcement, making it easier for a skill to perform unexpected external requests or expand capabilities without transparent consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance, 'Use when someone asks to generate or create tattoo design generator images,' is broad and imprecise, which can cause the skill to trigger in loosely related contexts. Overbroad activation can lead to unnecessary execution of Bash-based workflows, accidental token usage, or unintended external API calls when a generic image or design request is made.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The install instruction uses npx skills without pinning a specific version, which creates a supply-chain risk because users may fetch and execute whatever package version is current at install time. If the upstream package is compromised or a breaking/malicious version is published, users could execute unreviewed code during installation or use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tattoodesigngenerator.js (reported line 69)May include surrounding context.

js

};
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tattoodesigngenerator.js (reported line 69)May include surrounding context.

js

};
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tattoodesigngenerator.js (reported line 99)May include surrounding context.

js

};
  }

  const res = await fetch('https://api.talesofai.com/v3/make_image', {
    method: 'POST',
    headers: HEADERS,
    body: JSON.stringify(body),

Static analysis

No suspicious patterns detected.