Security checks across malware telemetry and agentic risk
The skill appears to generate images as advertised, but it sends prompts and an API token to a remote TalesOfAI endpoint that is not consistently disclosed as the actual recipient.
Review before installing. Use only a low-scope token intended for the actual talesofai.cn/Neta service, avoid sensitive personal details in prompts or reference images, and avoid passing long-lived tokens directly on the command line. The artifacts do not show malware, persistence, or destructive behavior, but the publisher should fix the provider disclosure and token-handling inconsistencies.
async function main() {
let taskUuid;
const makeRes = await fetch("https://api.talesofai.cn/v3/make_image", {
method: "POST",
headers,
body: JSON.stringify(body),async function main() {
let taskUuid;
const makeRes = await fetch("https://api.talesofai.cn/v3/make_image", {
method: "POST",
headers,
body: JSON.stringify(body),await new Promise((r) => setTimeout(r, 2000));
const pollRes = await fetch(
`https://api.talesofai.cn/v1/artifact/task/${taskUuid}`,
{ headers }
);63/63 vendors flagged this skill as clean.