PixelDojo
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: pixeldojo Version: 1.3.3 The PixelDojo skill bundle provides a legitimate integration for an AI image and video generation service. It includes shell and Python scripts (generate.sh, models.sh, scripts/generate-nano-banana.py) that interact with the https://pixeldojo.ai API to list models, submit generation tasks, and download the resulting media files. The implementation follows standard practices, such as using environment variables for API keys and sanitizing user input for filenames, with no evidence of malicious intent or data exfiltration.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone using this skill should understand that generated jobs run under their PixelDojo account and may consume subscription credits.
The helper uses the user's PixelDojo API key as a bearer token for generation and job-status API requests, which is expected for the service but grants access to the user's PixelDojo account capabilities.
API_KEY="${PIXELDOJO_API_KEY:-}" ... -H "Authorization: Bearer ${API_KEY}"Use a dedicated PixelDojo API key if available, monitor account usage, and leave PIXELDOJO_API_BASE at the default unless you intentionally trust an alternate endpoint.
The agent can create paid generation jobs and save or overwrite files at the chosen output location.
The script submits generation jobs to PixelDojo and downloads the resulting asset to a local path. This is purpose-aligned, but it is still a network action plus a local file write.
curl -sS -X POST "${API_BASE}/models/${MODEL}/run" ... curl -sS -L "$OUTPUT_URL" -o "$OUTPUT_PATH"Review the requested prompt, model, duration, and output path before allowing large or repeated generations, especially for video jobs or custom output paths.