Yearbook Photo Skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:18 AM UTC
• Version: 1.6.0

Overview

The skill mostly matches its image-generation purpose, but it has review-worthy risks around API-token handling, broad Bash scope, and unpinned installation.

Review before installing. Use only prompts and reference image IDs you are comfortable sending to the Neta/talesofai service, avoid putting real API tokens directly on the command line, and prefer a pinned or verified install path. The artifact does not show destructive behavior or persistence, but its token handling and scoping need care.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:33

Finding

Unpinned npx Package Execution Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

add omactiengartelle/yearbook-photo-skill ``` 2. Use a lockfile and registry integrity metadata where installation is performed within a managed Node.js project. 3. Document the expected package registry and warn users not to run the command against an untrusted registry or proxy. 4. Prefer an installation mechanism that verifies a cryptographic digest, signed release, or immutable commit. 5. Review newly published installer versions before updating the documented version. 6. Apply the same correction to both `SKILL.md` and `README.md`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: yearbookphoto.js:12

Finding

API Token Exposure Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose says the skill uses Neta AI for yearbook-photo generation, but the analyzed behavior indicates it contacts a different service (talesofai.cn), supports arbitrary prompts, and exposes reference-image editing behavior not disclosed in the description. This mismatch is dangerous because it hides real data flows and capabilities from users, enabling undisclosed transmission of prompts or images to an unexpected third party and expanding the misuse surface beyond the stated purpose.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to install and run the skill via npx skills without pinning a specific version. This can cause users to fetch and execute whatever package version is current at the time, increasing supply-chain risk if the upstream package is compromised or a malicious update is published.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README explicitly tells users to pass --token YOUR_NETA_TOKEN on the command line without warning that shell history, process listings, logging systems, or terminal capture may expose the secret. In this skill's context, the token directly authorizes use of a third-party image API, so disclosure could allow unauthorized API usage or account abuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares only a Bash tool and omits any explicit permission or allowed-tools scope, even though its documented behavior requires outbound network access to an external API. This weakens containment and reviewability because consumers cannot easily tell what capabilities the skill is expected to use, increasing the risk of unexpected network actions or abuse if the implementation changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

Installing the skill via an unpinned npx skills add omactiengartelle/yearbook-photo-skill reference allows the fetched package or resolver behavior to change over time without review. An attacker who compromises the upstream package, account, or dependency chain could cause users to install a different or malicious version than expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yearbookphoto.js (reported line 74)May include surrounding context.

js

async function main() {
  let taskUuid;

  const makeRes = await fetch("https://api.talesofai.cn/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yearbookphoto.js (reported line 74)May include surrounding context.

js

async function main() {
  let taskUuid;

  const makeRes = await fetch("https://api.talesofai.cn/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · yearbookphoto.js (reported line 103)May include surrounding context.

js

async function main() {
  let taskUuid;

  const makeRes = await fetch("https://api.talesofai.cn/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code posts the user-supplied prompt to a remote image-generation API and includes an authentication token in request headers. Aside from error handling, there is no confirmation prompt, informational print, or explanatory comment disclosing that user input and credentials are being sent off-box.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.