Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Neta Creative

v0.1.0

Neta API creative skill — generate images, videos, songs, and MVs, and deconstruct creative ideas from existing works. Use this skill when the user wants to...

0· 187·0 current·0 all-time
byHu Xiuhan@huxiuhan

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for huxiuhan/neta-creative.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Neta Creative" (huxiuhan/neta-creative) from ClawHub.
Skill page: https://clawhub.ai/huxiuhan/neta-creative
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install neta-creative

ClawHub CLI

Package manager switcher

npx clawhub@latest install neta-creative
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The skill's stated purpose (create/edit images, videos, songs via the Neta API) matches the commands in SKILL.md (neta-cli make_image/make_video/make_song/etc.). However the SKILL.md requires an environment variable (NETA_TOKEN) and recommends installing an npm/pnpm package ( @talesofai/neta-skills ), while the registry metadata lists no required env vars or install spec — an incoherence between claimed requirements and declared metadata.
Instruction Scope
The runtime instructions are focused on calling neta-cli commands for content generation and character queries. Examples show saving/reading cached JSON files (character_cache/search_cache) and using read_collection outputs and ref_img UUIDs. There are no instructions to read unrelated system files, collect arbitrary system data, or transmit data to unexpected endpoints within the SKILL.md itself.
!
Install Mechanism
Although instruction-only (no install spec), SKILL.md tells users to install neta-cli and run npm/pnpm global installs of @talesofai/neta-skills. That is an out‑of‑band package install from the public npm ecosystem (not tracked in registry metadata). This is reasonable for a CLI‑based skill but increases risk because the package source and integrity are not declared by the registry. The skill does not provide a vetted install URL or checksum.
!
Credentials
The SKILL.md explicitly requires a NETA_TOKEN environment variable, which is proportional to calling an API/CLI. However the registry metadata declares no required environment variables or primary credential — that mismatch is suspicious. Users should expect a single API token to be needed for this purpose, but it should be declared in the registry metadata.
Persistence & Privilege
The skill is not marked always:true and is user-invocable. It is instruction-only and does not request persistent system privileges or claim to modify other skills or system-wide agent configuration.
What to consider before installing
This skill appears to do what it says (drive a Neta CLI to generate media), but there are a few mismatches you should reconcile before installing or using it: - SKILL.md expects a NETA_TOKEN but the registry metadata does not declare any required environment variables. Treat that as a red flag: confirm where the token is used/stored and whether it is necessary for your intended use. Do not supply high‑privilege credentials unless you verify the service. - The skill asks you to install @talesofai/neta-skills globally via npm/pnpm and to use neta-cli. Verify the package and neta-cli packages on the official npm registry (check publisher, download counts, repository, and recent release notes). If possible, install in an isolated environment (container or VM) or review the package source before running. - Because this is instruction-only, the skill will tell your agent to run CLI commands. That is expected, but means the real security surface is the external CLI/package. Ensure the CLI is trustworthy and that the token you supply is scoped minimally (least privilege) and revocable. - If you plan to cache outputs locally (examples use character_cache/...), keep privacy in mind and avoid storing sensitive tokens in those files. Prefer ephemeral tokens or auditing of network calls if possible. If you want to proceed: ask the publisher for the canonical package repository URL, confirm the exact permission scope of NETA_TOKEN, and request the registry metadata be updated to declare NETA_TOKEN as a required environment variable (or remove the requirement from SKILL.md) so the manifest and instructions align.

Like a lobster shell, security has layers — review code before you run it.

latestvk973sscfm0x5556m6dgv969wb983296w
187downloads
0stars
1versions
Updated 4h ago
v0.1.0
MIT-0

Neta Creative Skill

Used to interact with the Neta API for multimedia content creation and creation‑related character queries.

Instructions

  1. For tasks that create or edit concrete assets (images, videos, songs, MVs, background removal), follow this flow:
    • Before creation, use character queries to fetch canonical character settings, then generate images/videos/songs based on them.
    • To reverse‑engineer creative ideas from an existing work, call read_collection and combine the result with the guidance in the reference docs.
  2. If, during creation, you discover that the real need is more like “browse recommendations / casually explore / research topics”, combine this skill with neta-community or neta-suggest instead of overloading this skill.

Prerequisites

Make sure the NETA_TOKEN environment variable is set.

Also ensure the latest Neta CLI is installed:

neta-cli --version
0.8.0
npm i @talesofai/neta-skills@latest -g
pnpm add -g @talesofai/neta-skills@latest

Commands

Content creation

Generate image

neta-cli make_image --prompt "@character_name, /elementum_name, ref_img-uuid, description1, description2" --aspect "3:4"

📖 Detailed guide — prompt structure, aspect ratio choices, examples.

Generate video

neta-cli make_video --image_source "image URL" --prompt "action description" --model "model_s"

📖 Detailed guide — motion description principles, model selection.

Generate song

neta-cli make_song --prompt "style description" --lyrics "lyrics content"

📖 Detailed guide — style prompts, lyrics format.

Create MV

Combine an audio track and video to create a full MV.

📖 Detailed guide — end‑to‑end workflow.

Remove background

neta-cli remove_background --input_image "image_url"

Character queries

Search characters

neta-cli search_character_or_elementum --keywords "keywords" --parent_type "character" --sort_scheme "exact"

📖 Detailed guide — search strategies and parameter choices.

Get character details

neta-cli request_character_or_elementum --name "character_name"

Query by UUID

neta-cli request_character_or_elementum --uuid "uuid"

Creative idea deconstruction

Derive creative ideas from a work

neta-cli read_collection --uuid "collection-uuid"

📖 Detailed guide

Reference docs

ScenarioDoc
🎨 Image generationimage-generation.md
🎬 Video generationvideo-generation.md
🎵 Song generationsong-creation.md
🎞️ MV creationsong-mv.md
👤 Character queriescharacter-search.md
🖊️ Creative remixingcollection-remix.md

Comments

Loading comments...