Ccy Txt2img

AdvisoryAudited by Static analysis on May 7, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If Pillow is not already installed, the user or environment may need to install it separately.

Why it was flagged

The code depends on Pillow, while the registry shows no install spec. This is purpose-aligned but means dependency installation/provenance is outside the reviewed install mechanism.

Skill content

from PIL import Image, ImageDraw, ImageFont

Recommendation

Install Pillow only from trusted package sources and consider adding a pinned dependency or install spec for clearer provenance.

Note

ASI02: Tool Misuse and Exploitation

What this means

Generated images may be written wherever the caller specifies, including over an existing file.

Why it was flagged

The skill writes generated images to a caller-supplied output path. This is expected for an image-generation skill, but it can overwrite files if used carelessly.

Skill content

os.makedirs(os.path.dirname(os.path.abspath(output_path)) or ".", exist_ok=True)
...
image.save(output_path, format="PNG")

Recommendation

Use explicit output paths in a safe project or downloads directory, and confirm before overwriting existing files.