v1.0.0

Generate artist-backed illustrations by Antekirt

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:25 AM.

Analysis

The skill appears to be a straightforward Antekirt API client, but it will use your Antekirt API key and can spend account credits when generating images, SVGs, or videos.

GuidanceInstall this only if you intend to use Antekirt from OpenClaw. Set the base URL to the official Antekirt endpoint, use a revocable API key, avoid placing secrets in generation prompts, and review credit costs before asking the agent to generate images, SVGs, or videos.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

**Cost:** 3 credits per image. ... **Cost:** 5 credits. ... **Cost:** 25 credits.

The skill exposes commands that submit generation, SVG, and video jobs that consume account credits. The costs are disclosed and aligned with the purpose.

User impactMistaken or overly broad use could consume Antekirt credits, especially for video generation.

RecommendationReview the requested artist, prompt, and operation cost before running image, SVG, or video generation, and consider requiring manual approval for high-cost actions.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The registry information does not provide an upstream source or homepage to verify publisher provenance, although the included script itself is visible in the artifacts.

User impactIt is harder to independently confirm that this skill is the official or intended Antekirt integration before supplying an API key.

RecommendationVerify the publisher and API domain through Antekirt's official channels before installing or providing credentials.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

scripts/antekirt.js

const API_KEY = process.env.ANTEKIRT_API_KEY; ... headers: { 'x-api-key': API_KEY, 'content-type': 'application/json' }

The skill authenticates API requests with the user's Antekirt API key. This is expected for the service, but it grants account-level access for supported Antekirt actions.

User impactAnyone running the skill with this environment can use the configured Antekirt account for artist lookup and generation requests.

RecommendationUse a revocable or scoped API key if available, keep ANTEKIRT_BASE_URL set to the official Antekirt endpoint, and rotate the key if it may have been exposed.