Invoke ARTCLAW platform's AI content creation capabilities via REST API. Supports AI image generation, video generation, workflow execution, multimodal analysis, and more.

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone installing it must grant access to an ARTCLAW account, which may allow paid job submission or account/job queries depending on the API key’s privileges.

Why it was flagged

The skill requires an ARTCLAW API key and uses it as an account-level credential for authenticated generation, analysis, workflow, and job-management requests.

Skill content
"auth": { "type": "apiKey", "headerName": "X-API-KEY", "prefix": "vk_", "required": true }
Recommendation

Use a dedicated ARTCLAW API key with the minimum privileges available, monitor credit usage, and revoke the key if the skill is no longer needed.

What this means

If Feishu delivery is used, the skill can send generated media through the configured Feishu app/account to the recipient supplied to the helper.

Why it was flagged

The Feishu delivery helper reads local OpenClaw Feishu configuration to obtain app credentials for sending media messages.

Skill content
config_path = os.path.expanduser("~/.openclaw/openclaw.json")
Recommendation

Only enable or invoke Feishu/Telegram delivery when you intend to send the result, and verify the destination recipient or chat before delivery.

What this means

If a private local file path is provided as a reference, that file’s contents may be sent to the ARTCLAW service as part of the generation request.

Why it was flagged

The documented CLI can read local files supplied as reference inputs and encode them for use in generation requests.

Skill content
`--reference-files` | Local reference files, auto-converted to base64 | One or more paths
Recommendation

Pass only files you intentionally want to use as references, and avoid providing paths to unrelated private documents.

What this means

Generation jobs may continue running after the main agent response, and results may be delivered later.

Why it was flagged

The OpenClaw adapter intentionally uses spawned/background execution for long-running generation or workflow jobs.

Skill content
Pass `sessions_spawn_args` to `sessions_spawn`. Immediately tell the user the job has been submitted. Do not wait silently in the main agent.
Recommendation

Monitor spawned/background tasks and use the platform’s cancellation or job-status features if a job was started by mistake.

What this means

API configuration, job metadata, prompts, or result URLs may remain on disk and be reused by later runs.

Why it was flagged

The skill persists configuration and job data locally, and adapters may later read last_job.json to report results.

Skill content
All local ARTCLAW data is stored under `~/.artclaw/`, including `config.json`, `last_job.json`, and `history/`.
Recommendation

Avoid using sensitive prompts or reference content unless necessary, and clear ~/.artclaw if you do not want local job history retained.

What this means

If an update path uses that tarball, future code could differ from the reviewed package contents.

Why it was flagged

The manifest points updates at the moving main branch rather than a pinned release artifact.

Skill content
"update": { "method": "tarball", "url": "https://github.com/ArtClaw1/artclaw-skill/archive/refs/heads/main.tar.gz" }
Recommendation

Prefer pinned releases or review the GitHub source before updating the skill.