中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:23 hr ago Rescan
15 /100
caricature-portrait-generator
Generate hilarious AI caricature portraits with exaggerated features via the Neta AI image generation API
A legitimate caricature image generation skill that makes HTTPS API calls, but SKILL.md misleadingly declares the Bash tool without any shell execution actually occurring in the implementation.
Skill Namecaricature-portrait-generator
Duration27.4s
Enginepi
✓
Safe to install
Fix the SKILL.md to accurately reflect the tool: use Read or no tool declaration instead of Bash, since the script only runs Node.js with built-in https module.

Findings 2 items

Severity Finding Location
Low
Bash tool declared without corresponding functionality Doc Mismatch
SKILL.md declares `tools: Bash` on line 3, but the entire codebase contains zero child_process, exec, spawn, or shell command invocations. The script is a pure Node.js app using only built-in https module. The Bash declaration is a false positive — no shell-level execution occurs.
tools: Bash
→ Remove the Bash tool declaration from SKILL.md or replace it with a note that the skill only uses Node.js built-in modules.
 SKILL.md:3
Low
Network access undeclared in SKILL.md Doc Mismatch
The script makes HTTPS requests to api.talesofai.com (Neta AI image generation API) but SKILL.md makes no mention of network access. This is a minor doc gap — the network use is necessary and proportional to the stated purpose.
await request('POST', 'api.talesofai.com', '/v3/make_image', body)
→ Add a note in SKILL.md that the skill makes outbound HTTPS requests to api.talesofai.com for image generation.
 caricatureportraitgenerator.js:69
ResourceDeclaredInferredStatusEvidence
Shell WRITE NONE ✓ Aligned SKILL.md:3 declares tools: Bash, but JS file has no child_process, exec, spawn, …
Network NONE READ ✓ Aligned caricatureportraitgenerator.js:69-75 makes HTTPS POST/GET to api.talesofai.com —…
Filesystem NONE NONE — No file read/write operations in the JS implementation
Environment NONE NONE — No environment variable access in the JS implementation
1 findings
🔗
Medium External URL 外部 URL
https://www.neta.art/open/
README.md:19

File Tree

4 files · 7.7 KB · 252 lines
JavaScript 1f · 140L Markdown 2f · 111L JSON 1f · 1L
├─ 📜 caricatureportraitgenerator.js JavaScript 140L · 3.5 KB
├─ 📋 package.json JSON 1L · 188 B
├─ 📝 README.md Markdown 77L · 2.6 KB
└─ 📝 SKILL.md Markdown 34L · 1.4 KB

Security Positives

✓ No subprocess, exec, or shell command execution found — script runs purely via Node.js built-in modules
✓ No credential harvesting or environment variable iteration
✓ No data exfiltration or C2 communication — only makes legitimate API calls to the documented endpoint
✓ No obfuscation, base64 decoding, or anti-analysis techniques
✓ No filesystem writes or sensitive path access (~/.ssh, ~/.aws, .env, etc.)
✓ No supply chain risks — package.json has no external dependencies, only Node.js built-ins
✓ No persistence mechanisms (cron, startup hooks, backdoors)
✓ Token is passed via CLI flag only, not read from environment or sensitive files