neta-creative

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx -y @talesofai/neta-skills@latest to download and execute the latest version of the vendor's toolset from the npm registry. This is the primary mechanism for accessing the skill's functionality and is consistent with the author's identity.
  • [COMMAND_EXECUTION]: All creative and administrative tasks are performed by executing shell commands via the neta-skills CLI. These commands include content generation (make_image, make_video, make_song), character management (search_character_or_elementum), and account services (get_current_premium_plan).
  • [DATA_EXFILTRATION]: The upload command allows the agent to read local files or fetch remote URLs and register them as artifacts on the Neta platform. While this involves transmitting data to an external service, it is a documented and necessary feature for the skill's intended purpose of media processing.
  • [DATA_EXPOSURE]: The skill processes user-provided data via the read_collection command and local file paths via the upload command. These ingestion points are used to influence downstream creative generation prompts and asset processing.
  • Ingestion points: read_collection (API data) and upload (local filesystem access via --file_path).
  • Boundary markers: The instructions do not explicitly define boundary markers for the data returned from read_collection when it is interpolated into creative prompts.
  • Capability inventory: Subprocess execution for all npx commands across all reference files and the main skill body.
  • Sanitization: The documentation describes a moderation step for uploaded media, but manual prompt sanitization is not detailed.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 10:13 AM