ClawHub
Back to skill

Security audit

Mockup Gen Skill

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill mostly matches its stated purpose, but it needs review because it transmits prompts and API tokens to an external service while using weak credential and install guidance.

Install only from a source or version you trust, and confirm that api.talesofai.cn is the intended Neta service endpoint before sending data. Use a low-scope, revocable API token, avoid sensitive or confidential prompts, and be aware this version requires passing the token on the command line despite documenting NETA_TOKEN support.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party Installation Command Creates Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
mockupgen.js:3
Finding

API Token Exposed Through Command-Line Arguments

Content
View full analysis
"your prompt" --token "$NETA_TOKEN" ``` `SKILL.md:22-25`: ```bash node mockupgen.js "your description here" --token YOUR_TOKEN ``` The project metadata declares a `NETA_TOKEN` environment variable, and the documentation claims that the script resolves it, but the implementation assigns the token only from `tokenFlag` and never reads `process.env.NETA_TOKEN`. ### Technical Analysis Secrets passed as command-line arguments become part of the process argument vector. Depending on the operating system, process isolation configuration, container environment, diagnostic tooling, and monitoring setup, those arguments may be visible through process inspection, telemetry, crash reports, audit logs, or support bundles. Examples containing a literal token can also encourage users to place credentials directly into shell commands. Literal commands ...[truncated 1825 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A description-behavior mismatch involving a different external service than the one advertised is a serious trust violation. If the skill claims to use Neta AI but actually sends prompts, tokens, or reference images to another domain, users may unknowingly disclose secrets or copyrighted/private content to an unvetted third party; the undeclared --ref capability further increases risk by enabling hidden upload of local or sensitive images.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The README instructs users to install and run the skill via npx skills without pinning an exact package/version. This can expose users to unexpected upstream changes or a compromised latest release, which is a real supply-chain risk for installation flows.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly recommends passing the API token on the command line (--token YOUR_NETA_TOKEN) without warning that command-line arguments may be exposed through shell history, process listings, logs, or telemetry. Because this skill interacts with a remote API and returns URLs, leaking the token could allow unauthorized API use or quota abuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill declares Bash usage and documents invocation of a script that requires external API access, but it does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: an agent or user may approve or execute the skill without clear notice that it will make network calls and transmit prompts and tokens to a third party.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
77% confidence
Finding

Using npx skills add wkl-nieta/mockup-gen-skill without a pinned version introduces supply-chain risk because the fetched package or skill can change over time. An attacker who compromises the publisher account, package source, or a later release could cause users to install modified content without changing the install command.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The hardcoded external endpoint indicates intentional transmission to a remote service. While this is consistent with an image-generation skill, it is still a true security concern because it sends potentially sensitive user prompts and credentials to a third party, increasing privacy and supply-chain risk if the endpoint is compromised or unexpected.

Content

Scanner excerpt · mockupgen.js (reported line 66)May include surrounding context.

js
// --- Submit job ---
async function submitJob() {
  const res = await fetch("https://api.talesofai.cn/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The hardcoded external endpoint indicates intentional transmission to a remote service. While this is consistent with an image-generation skill, it is still a true security concern because it sends potentially sensitive user prompts and credentials to a third party, increasing privacy and supply-chain risk if the endpoint is compromised or unexpected.

Content

Scanner excerpt · mockupgen.js (reported line 66)May include surrounding context.

js
// --- Submit job ---
async function submitJob() {
  const res = await fetch("https://api.talesofai.cn/v3/make_image", {
    method: "POST",
    headers: HEADERS,
    body: JSON.stringify(body),

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script sends the user-provided prompt and authentication token to a third-party API endpoint without any in-script disclosure, consent prompt, or privacy warning. Because prompts may contain sensitive business data and the token is an access credential, silent transmission to an external service creates a real confidentiality and credential-exposure risk, even though network use is expected for this skill’s function.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mockupgen.js (reported line 86)May include surrounding context.

js
// --- Poll for result ---
async function pollTask(taskUuid) {
  const url = `https://api.talesofai.cn/v1/artifact/task/${taskUuid}`;
  const PENDING_STATUSES = new Set(["PENDING", "MODERATION"]);
  const MAX_ATTEMPTS = 90;
  const INTERVAL_MS = 2000;

Static analysis

No suspicious patterns detected.