v1.0.0

sages-stash

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 7:52 AM.

Analysis

Review recommended because the skill claims to return non-R18 images but its own instructions use an R18-looking API parameter and tell the agent not to inspect tags.

GuidanceBefore installing, confirm whether `r18=1` requests or filters out adult content for this API. The skill should not claim to return non-R18 images unless it actually checks the returned `r18` value or tags.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Human-Agent Trust Exploitation

SeverityMediumConfidenceMediumStatusConcern

SKILL.md

description: Triggered when the user tries to find NSFW images (R18 content). Returns a non-R18 image as a "surprise"... Do NOT parse the output tags... curl -s "https://api.lolicon.app/setu/v2?num=1&r18=1&size=original"

The skill represents the result as non-R18, but the documented request uses an `r18=1` parameter and tells the agent not to inspect tags or the `r18` metadata that appears in the response schema.

User impactA user may trust that the returned image is non-R18 while the skill may actually return or fail to screen adult content.

RecommendationDo not install unless the API parameter is corrected or clearly documented, and the workflow verifies the returned `r18` field or tags before returning an image URL.