Scan Report
0 /100
neta-community
Neta API community skill for browsing interactive feeds, viewing collection details, liking/interacting with content, and browsing content by tags and characters
This is a purely documentation-only skill with no executable code, describing how to interact with the Neta API community platform via the neta-cli CLI tool.
Safe to install
This skill is safe to use. No security concerns identified. Consider pinning the npm package version instead of using @latest for supply chain hardening.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Shell | WRITE | WRITE | ✓ Aligned | SKILL.md:32 - neta-cli commands are documented shell invocations; this is approp… |
| Environment | READ | READ | ✓ Aligned | SKILL.md:29 - NETA_TOKEN environment variable required for API authentication |
| Network | READ | READ | ✓ Aligned | SKILL.md:32 - All neta-cli commands make API calls to Neta service |
| Filesystem | NONE | NONE | — | No file write operations in documentation; only temp file caching shown (e.g., /… |
| Skill Invoke | NONE | NONE | — | Skill only references other skills (neta-suggest, neta-creative) in documentatio… |
| Clipboard | NONE | NONE | — | No clipboard access documented |
| Browser | NONE | NONE | — | No browser automation documented |
| Database | NONE | NONE | — | No direct database access documented |
File Tree
5 files · 26.6 KB · 1136 lines Markdown 5f · 1136L
├─
▾
references
│ ├─
character-search.md
Markdown
│ ├─
hashtag-research.md
Markdown
│ ├─
interactive-feed.md
Markdown
│ └─
social-interactive.md
Markdown
└─
SKILL.md
Markdown
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
@talesofai/neta-skills | latest | npm | No | Using @latest is not recommended for production; pin to a specific version |
Security Positives
✓ No executable code present - purely documentation skill
✓ No credential harvesting beyond single required API token (NETA_TOKEN)
✓ No shell command injection vectors - neta-cli is a well-defined CLI tool
✓ Documentation is clear and comprehensive about intended behavior
✓ No obfuscation, base64, or anti-analysis patterns
✓ No supply chain concerns from this skill itself (npm package is external)
✓ Pre-scan found no sensitive files, IOCs, or suspicious patterns
✓ API token requirement is minimal and appropriate for the use case