ClawHub
Back to skill

Security audit

Ghibli Style Skill

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill appears functional, but it should be reviewed carefully because it handles an API token through command-line arguments and its runtime API destination is not consistently disclosed across the skill metadata.

Install only if you are comfortable sending prompts and your API token to the documented external image service. Prefer a version-pinned install path, avoid putting tokens on the command line, and verify the provider relationship between Neta and api.talesofai.com before using a real account token.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party Installer Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
ghiblistyle.js:3
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis
"your prompt" --token "$NETA_TOKEN" ``` The manifest declares an environment variable: ```json "clawhub": { "env": [ { "name": "NETA_TOKEN", "description": "Neta AI API token. Get it at https://www.neta.art/open/", "required": true } ] } ``` However, the implementation does not read `process.env.NETA_TOKEN`. It only accepts the token through `--token`. ### Technical Analysis Command-line arguments are generally not an appropriate channel for secrets. While the process is running, the expanded token is part of the Node.js process argument vector. Depending on the operating system and host configuration, arguments may be observable through process insp ...[truncated 2132 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documented behavior says the skill uses the Neta API, but the analyzed behavior reportedly contacts a different external service, supports undeclared --ref functionality, and performs authenticated network requests without declared permissions. That mismatch is a major trust violation because it can conceal where prompts, images, and tokens are actually sent, and hidden features may enable unreviewed data flows or abuse paths.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to pass an API token directly on the command line, which can expose the credential through shell history, process listings, CI logs, and shared terminal transcripts. Because this skill interacts with a third-party API service, accidental token disclosure could let others consume the user's quota or access their account-backed image generation service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises Bash-based execution and authenticated API usage but does not declare any tool scope or allowed permissions, despite requiring network access. This creates a transparency and policy-enforcement gap: an agent or reviewer cannot reliably constrain what the skill is allowed to do, increasing the chance of unintended outbound requests or token misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation guidance is overly broad, telling the agent to use the skill whenever someone asks to generate this class of images, without constraints around consent, copyrighted inputs, sensitive content, cost, or token availability. Broad triggers increase the likelihood of unnecessary or unsafe execution, especially for a networked skill that consumes credentials and sends user content to a third-party service.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Using an unpinned npx skills install path allows the fetched package version to change over time, which can introduce supply-chain risk if a malicious or compromised release is published. Because installation occurs at execution time, users may unknowingly run different code than what was reviewed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata says it uses the Neta AI API, but the code actually sends prompts and the supplied token to TalesOfAI endpoints while also presenting a mismatched platform identifier. This is dangerous because it deceives users about where their data and credentials are being sent, undermines informed consent, and strongly suggests credential harvesting or unauthorized third-party use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The hardcoded external endpoint at talesofai.com is itself suspicious in context because the skill claims to use Neta AI. In an image-generation skill, external transmission can be normal, but the mismatch makes this substantially more dangerous by indicating covert routing of user data and secrets to another service.

Content

Scanner excerpt · ghiblistyle.js (reported line 60)May include surrounding context.

js
}

// --- Submit job ---
const submitRes = await fetch("https://api.talesofai.com/v3/make_image", {
  method: "POST",
  headers: HEADERS,
  body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The hardcoded external endpoint at talesofai.com is itself suspicious in context because the skill claims to use Neta AI. In an image-generation skill, external transmission can be normal, but the mismatch makes this substantially more dangerous by indicating covert routing of user data and secrets to another service.

Content

Scanner excerpt · ghiblistyle.js (reported line 60)May include surrounding context.

js
}

// --- Submit job ---
const submitRes = await fetch("https://api.talesofai.com/v3/make_image", {
  method: "POST",
  headers: HEADERS,
  body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The polling request repeatedly contacts the same undisclosed third-party service using the user's token in headers, extending exposure beyond the initial submission. While polling for job completion is normal behavior for this type of skill, doing so against a mismatched provider increases the window for credential misuse and unnecessary data sharing.

Content

Scanner excerpt · ghiblistyle.js (reported line 90)May include surrounding context.

js
for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
  await sleep(POLL_INTERVAL_MS);

  const pollRes = await fetch(`https://api.talesofai.com/v1/artifact/task/${task_uuid}`, {
    headers: HEADERS,
  });

Static analysis

No suspicious patterns detected.