Waifu Generator Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:46 AM UTC
• Version: 3.0.0

Overview

This skill does what it claims, but users should understand it sends prompts and an API token to an external image-generation service.

Install only if you are comfortable sending your image prompts, optional reference image UUIDs, and Neta API token to api.talesofai.com. Avoid putting long-lived or high-value tokens directly in shell commands when possible, rotate the token if it may have been logged, and prefer a pinned or verified install source if available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: waifugenerator.js:11

Finding

API Token Exposure Through Command-Line Arguments

Content

View full analysis

"your prompt" --token YOUR_TOKEN ``` ### Technical Analysis The skill accepts its Neta API token exclusively through the `--token` command-line argument. Command-line arguments are not an appropriate secret-transport mechanism because they can be exposed through: - Shell history files. - Process listings and process inspection interfaces. - Command telemetry, terminal logging, or audit systems. - Wrapper scripts and automation logs that record complete commands. The token is legitimately transmitted to the intended API through the `x-token` header, but its initial acquisition through `process.argv` unnecessarily exposes it on the local system. No hardcoded token or transmission to an unrelated domain was identified. ### Attack Path 1. A user follows the documented command and supplies a valid token using `--token`. 2. The shell records the complete command in its history, or the argument remains visible through process inspection while the script is running. 3. Another local user, monitoring tool, support bundle, or log collector obtains the command-line contents. 4. The exposed token is extracted and replayed against the Neta API. 5. The attacker performs API operations within the authorization and quota associated with the compromised token. ### Impact Assessment Successful exploitation does not grant additional operating-syst ...[truncated 324 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Remote Installation Chain

Content

View full analysis

Remediation

View remediation

add TomCarranzaem/waifu-generator-skill@ ``` The actual syntax should be verified against the installer, and the resulting artifact should be checked against a published checksum or signature. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding indicates a substantial description-behavior mismatch: the skill claims to use Neta AI but reportedly interacts with a different external service, includes reference-image editing behavior, and exposes CLI token handling not fully declared in the description. This kind of mismatch is dangerous because it undermines informed consent, conceals where sensitive prompts and credentials go, and may hide additional capabilities from reviewers and users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README states that prompts are sent to the Neta/talesofai API and also documents --ref reference-image usage, but it does not explicitly warn users that their prompts, tokens, and image identifiers may be transmitted to a third-party service. In an image-generation skill, this context makes the issue more significant because users may submit sensitive text or reference images assuming local-only processing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The README instructs users to install and run the skill via npx skills without pinning a specific version or immutable source. That creates a supply-chain risk: users may fetch whatever package/version is current at execution time, which could be replaced, updated maliciously, or differ from what was reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The ClawHub install example references the skill by name only, without a pinned version or immutable identifier. This similarly exposes users to supply-chain drift or takeover risk if the published artifact changes after review.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares only the Bash tool and does not specify any explicit tool scope or permissions, yet its described behavior clearly requires outbound network access to an external API. This creates a transparency and least-privilege problem: users and hosting systems cannot easily tell that prompts and tokens will be transmitted off-platform, increasing the risk of unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description does not clearly warn that user prompts and token-authenticated requests are transmitted to a third-party image generation service. This is a material omission because prompts may contain sensitive content and the token is a credential; users need clear notice before data leaves the local environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger guidance is very broad and can cause the skill to activate on generic requests to create images without meaningful constraints or confirmation. In a skill that sends prompts and authenticated requests to an external service, overbroad activation increases the chance of accidental invocation, unintended data sharing, and surprising external actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The install instruction uses npx skills without pinning a specific version, which makes installation dependent on whatever package version is current at execution time. This weakens supply-chain integrity because a later compromised or incompatible release could be fetched and executed unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This finding highlights the hardcoded external destination https://api.talesofai.com/ used for image job submission. Hardcoded outbound network calls are risky in agent skills because they send user input and authentication material off-platform, and here the unexpected mismatch with the advertised Neta AI service makes the transmission more suspicious.

Content

Scanner excerpt · waifugenerator.js (reported line 70)May include surrounding context.

js

// --- Submit job ---
async function submitJob() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This finding highlights the hardcoded external destination https://api.talesofai.com/ used for image job submission. Hardcoded outbound network calls are risky in agent skills because they send user input and authentication material off-platform, and here the unexpected mismatch with the advertised Neta AI service makes the transmission more suspicious.

Content

Scanner excerpt · waifugenerator.js (reported line 70)May include surrounding context.

js

// --- Submit job ---
async function submitJob() {
  const res = await fetch("https://api.talesofai.com/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The polling request repeatedly contacts the same third-party API and includes the authentication header, extending exposure of credentials and metadata across many outbound requests. While it mainly retrieves job status, it still increases the attack surface and operational leakage to an external service.

Content

Scanner excerpt · waifugenerator.js (reported line 89)May include surrounding context.

js

// --- Poll for result ---
async function pollTask(taskUuid) {
  const url = `https://api.talesofai.com/v1/artifact/task/${taskUuid}`;
  const MAX_ATTEMPTS = 90;
  const INTERVAL_MS = 2000;

Static analysis

No suspicious patterns detected.