ClawHub
Back to skill

Security audit

Chibi Gen Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward AI image generator, but users should understand that prompts and tokens go to an external service and the token handling is not ideal.

Reasonable to install if you are comfortable sending prompts, reference IDs, and a Neta/Tales of AI token to api.talesofai.com. Prefer a low-scope or disposable token, avoid confidential prompts, and avoid passing literal tokens on the command line. Use a pinned or trusted install path where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:11
Finding

Unpinned Package Execution in Documented Installation Command

Content
View full analysis
Remediation
View remediation
add TomCarranzaem/chibi-gen-skill ``` 2. Prefer a lockfile-backed installation process where package versions and integrity hashes are verified. 3. Document the expected package registry and publisher identity. 4. Review the pinned installer version, including lifecycle scripts and transitive dependencies, before recommending it. 5. Update the version only through a controlled dependency-review process. 6. Where supported, disable unnecessary package lifecycle scripts during installation. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
chibigen.js:14
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis
"your prompt" --token "$NETA_TOKEN" ``` ### Technical Analysis The API token is accepted through the `--token` command-line argument. On operating systems where process arguments are visible to other local users, monitoring agents, process-inspection utilities, or diagnostic tooling, the expanded token may be exposed in the process command line while the program is running. Commands containing a literal token may also be retained in shell history. Even when the command expands an environment variable, the resulting value can still appear in process argument inspection. `package.json` declares `NETA_TOKEN` as a required environment variable, but `chibigen.js` never reads `process.env.NETA_TOKEN`. This configuration mismatch encourages users to place the secret in a less secure argument channel. ### Attack Path 1. A victim starts image generation with: ```bash node chibigen.js "prompt" --token SECRET_TOKEN ``` or expands the environment variable into the same argument. 2. While the process is active, a local attacker or process-monitoring component reads its command-line arguments using operating-system process inspection facilities. 3. Alternatively, a literal-token invocation remains in the user's shell history or captured command logs. 4. The attacker extracts the Neta API ...[truncated 806 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented behavior says the skill uses Neta AI, but the analyzed behavior indicates it actually contacts a different external service and supports undocumented reference-image editing features. This is dangerous because users may disclose prompts, tokens, or images under false assumptions about where data is sent and what operations are performed, which strongly suggests deceptive or intentionally obscured behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README says the skill is powered by an external API and returns an image URL, but it does not clearly warn users that their prompts and --ref identifiers are transmitted to a third-party image-generation service. This is a privacy and data-handling issue because users may submit sensitive text or reference identifiers without understanding that the data leaves the local environment. In an AI image generation skill, this context makes the omission material rather than theoretical.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The README instructs users to install and execute the skill via npx skills without pinning an exact package version. This creates a supply-chain risk because future package changes or a compromised upstream release could cause users to install or run unintended code. In a skill installation context, this is more dangerous because users are being told to execute a remote package manager command directly from documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares Bash tooling and appears to require outbound network access, but it does not constrain that access with explicit permissions or allowed-tools scope. In an agent setting, undeclared network capability weakens sandboxing and can enable unexpected external communication, especially when the skill also handles API tokens.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

Using 'npx skills add TomCarranzaem/chibi-gen-skill' without pinning a version makes installation non-reproducible and exposes users to supply-chain risk if the package or its dependencies change, are compromised, or are typosquatted later. In agent ecosystems, this can silently introduce malicious behavior after the skill was originally reviewed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Accepting the API token via a command-line argument exposes the credential to local process listings, shell history, logs, and telemetry on many systems. This increases the chance of accidental credential disclosure even if the network calls themselves are expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This code transmits user-supplied prompts, optional reference identifiers, and the authentication token to an external third-party API. External transmission is expected for an image-generation skill, but it is still security-relevant because sensitive user content and credentials leave the local environment, especially given the provider mismatch in the metadata.

Content

Scanner excerpt · chibigen.js (reported line 72)May include surrounding context.

js
// --- Submit job ---
async function main() {
  const makeRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This code transmits user-supplied prompts, optional reference identifiers, and the authentication token to an external third-party API. External transmission is expected for an image-generation skill, but it is still security-relevant because sensitive user content and credentials leave the local environment, especially given the provider mismatch in the metadata.

Content

Scanner excerpt · chibigen.js (reported line 72)May include surrounding context.

js
// --- Submit job ---
async function main() {
  const makeRes = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers,
    body: JSON.stringify(body),

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata claims it uses the Neta AI image generation API, but the implementation actually sends prompts and tokens to Tales of AI endpoints. This discrepancy can mislead users about where their data and credentials are being transmitted, undermining informed consent and trust boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The polling request sends the authentication header to the same external service repeatedly while checking task status. This is less sensitive than the initial job submission because it appears to send no prompt body, but it still discloses continued use of the token to a third-party endpoint and expands the external interaction surface.

Content

Scanner excerpt · chibigen.js (reported line 99)May include surrounding context.

js
await new Promise((r) => setTimeout(r, 2000));

    const pollRes = await fetch(
      `https://api.talesofai.com/v1/artifact/task/${taskUuid}`,
      { headers }
    );

Static analysis

No suspicious patterns detected.