neta-creative
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @talesofai/neta-skills@latestto download and execute the latest version of the vendor's toolset from the npm registry. This is the primary mechanism for accessing the skill's functionality and is consistent with the author's identity. - [COMMAND_EXECUTION]: All creative and administrative tasks are performed by executing shell commands via the
neta-skillsCLI. These commands include content generation (make_image,make_video,make_song), character management (search_character_or_elementum), and account services (get_current_premium_plan). - [DATA_EXFILTRATION]: The
uploadcommand allows the agent to read local files or fetch remote URLs and register them as artifacts on the Neta platform. While this involves transmitting data to an external service, it is a documented and necessary feature for the skill's intended purpose of media processing. - [DATA_EXPOSURE]: The skill processes user-provided data via the
read_collectioncommand and local file paths via theuploadcommand. These ingestion points are used to influence downstream creative generation prompts and asset processing. - Ingestion points:
read_collection(API data) andupload(local filesystem access via--file_path). - Boundary markers: The instructions do not explicitly define boundary markers for the data returned from
read_collectionwhen it is interpolated into creative prompts. - Capability inventory: Subprocess execution for all
npxcommands across all reference files and the main skill body. - Sanitization: The documentation describes a moderation step for uploaded media, but manual prompt sanitization is not detailed.
Audit Metadata