TensorLab Image

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: tensorslab-image Version: 1.0.1 The skill bundle provides a legitimate interface for interacting with the TensorsLab image generation and editing API. The Python script (scripts/tensorslab_image.py) is well-structured, focusing on API communication, task polling, and image downloading to a local directory. The documentation (SKILL.md and references/) provides clear instructions for the AI agent to perform image-related tasks without any evidence of malicious intent, data exfiltration, or unauthorized command execution.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Using the skill may consume TensorsLab credits and relies on protecting the API key.

Why it was flagged

The script reads a provider API key from the environment and sends it as a bearer token to TensorsLab, which is expected for this integration but gives the skill access to the user's TensorsLab account quota.

Skill content

api_key = os.environ.get("TENSORSLAB_API_KEY") ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated/revocable TensorsLab API key if possible, avoid sharing logs that include credentials, and rotate the key if it is exposed.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Any selected local image, including photos of people or private material, may be sent to TensorsLab for processing.

Why it was flagged

For image-to-image and editing workflows, local source images supplied to the script are opened and included in the multipart request to the external TensorsLab API.

Skill content

for img_path in source_images:
            f = open(img_path, "rb")
            ...
            files.append(("sourceImage", (os.path.basename(img_path), f)))

Recommendation

Only provide image files you are comfortable uploading to the provider, and check TensorsLab's privacy and retention terms for sensitive images.

NoteMedium Confidence

ASI02: Tool Misuse and Exploitation

What this means

Users who rely on a local or corporate proxy for network routing, monitoring, or access control may not get the expected proxy behavior for this script.

Why it was flagged

The HTTP session explicitly clears proxy settings for this client, which may bypass a user's configured proxy for these provider calls.

Skill content

_SESSION = requests.Session()
_SESSION.proxies = {"http": "", "https": ""}

Recommendation

If proxy use is required, review or modify this session configuration before running the script.

NoteHigh Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Outputs could be mistaken for unedited or authentic images if shared without disclosure.

Why it was flagged

The face replacement prompt template asks for edits that are hard to detect, which is disclosed and user-directed but can affect trust in generated media.

Skill content

The result should look natural and undetectable as an edit.

Recommendation

Use face replacement and watermark/object removal only with appropriate rights and consent, and disclose edits when sharing results.