Freepik

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Freepik API skill that requires a Freepik API key and sends requested generation/editing inputs to Freepik, with no artifact evidence of hidden or destructive behavior.

This skill appears appropriate if you want an agent to use Freepik's API. Before installing, understand that it needs your Freepik API key, may consume API credits, sends requested prompts and media to Freepik, and may store generated outputs under ~/.freepik/sessions/.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can make authenticated Freepik API requests and create local output folders when the skill is used.

Why it was flagged

The skill authorizes direct shell tool use for Freepik API calls, JSON parsing, and session-folder creation. This is central to the skill's API workflow and limited to Freepik-related curl targets, but it is still operational authority the user should notice.

Skill content
allowed-tools: Bash(curl *api.freepik.com*), Bash(curl **.freepik.com*), Bash(jq *), Bash(mkdir -p ~/.freepik/*)
Recommendation

Use the skill for intended Freepik tasks, review prompts and parameters before expensive operations, and stop long-running polling if a task appears stuck.

What this means

Requests are made under the user's Freepik account and may consume API credits or quota.

Why it was flagged

The skill uses the user's Freepik API credential to make requests. This is expected for the integration and is declared, with no evidence of hardcoding or unrelated transmission.

Skill content
All requests require the `FREEPIK_API_KEY` environment variable. **Header:** `x-freepik-api-key: $FREEPIK_API_KEY`
Recommendation

Use a dedicated Freepik API key if possible, monitor usage, and avoid exposing the key in prompts, logs, or shared terminal output.

What this means

Prompts and selected media files or URLs may leave the local environment and be processed by Freepik.

Why it was flagged

The documented workflows send prompts and, for editing/upscaling tasks, user-provided media inputs to Freepik's external API. This is purpose-aligned and disclosed, but users should treat it as an external data-sharing flow.

Skill content
Agent -->|curl POST| API[Freepik API] ... `/freepik edit upscale-creative --image "./photo.jpg" --scale 4`
Recommendation

Only provide images, audio, video, prompts, or URLs that you are comfortable sending to Freepik, and review Freepik's privacy and retention terms for sensitive content.