Unsplash
PassAudited by ClawScan on May 1, 2026.
Overview
This instruction-only Unsplash skill is coherent and purpose-aligned, but users should notice that it uses an Unsplash access key and may make download-tracking API calls.
Before installing or using this skill, be comfortable providing an Unsplash API access key and letting the agent make Unsplash API requests with it. Store the key securely, watch API rate limits, and ensure download-tracking calls are made only when you actually intend to download an image.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone or any agent process with access to that key could make Unsplash API requests under the user's Unsplash application and consume its rate limits.
The skill asks the user to provide and store an Unsplash API access key. This is expected for Unsplash API use, but it is still delegated account/app authority and is not declared in the registry credential metadata.
echo "YOUR_ACCESS_KEY" > ~/.config/unsplash/access_key ... export UNSPLASH_ACCESS_KEY="your_access_key_here"
Use a dedicated Unsplash application key, keep the file permissions restrictive, avoid sharing logs that include the key, and revoke or rotate the key if it may have been exposed.
Downloading through the skill may update Unsplash download metrics and use the user's API quota.
The skill documents a stateful Unsplash API call that records a download event. This is disclosed and aligned with Unsplash guidelines, but it is more than a read-only metadata request.
Track Download (Required!) ... curl "https://api.unsplash.com/photos/PHOTO_ID/download" ... This increments the download counter.
Only trigger download tracking when the user actually wants to download a photo, and avoid bulk or repeated download calls unless explicitly requested.