Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

PixelMagic-PhotoLogic-9z

v1.0.0

Professional image post-processing tool. Supports multiple editing styles (apocalyptic cinematic, Japanese fresh, vintage film, etc.), auto-detects and insta...

0· 54·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the runtime instructions: the SKILL.md focuses on ImageMagick-based editing, RAW support, batch processing, presets, and file management. The _skillhub_meta.json also lists ImageMagick as a system dependency — coherent with the stated purpose.
Instruction Scope
Instructions are specific to local image processing (create workspace, generate intermediate JPGs, record per-step params, build a final magick command). Two notes: SKILL.md instructs the agent to perform multimodal validation of intermediate JPGs (which may cause images to be sent to whatever multimodal model/endpoints the platform uses), and it says to auto-detect and prompt to install ImageMagick but gives no concrete install steps — both are expected for this skill but are privacy/operational considerations rather than incoherent behavior.
Install Mechanism
This is instruction-only with no install spec or downloaded code; that reduces disk-write risk. The only install-related claim is auto-detect/install ImageMagick — there is no packaged installer URL or extract step in the skill itself, so nothing unexpected is being pulled by the skill bundle.
Credentials
The skill requests no environment variables, credentials, or external config paths. All file and directory actions are local and directly related to image processing; there is no disproportionate access requested.
Persistence & Privilege
Flags are default (always:false, user-invocable:true). The skill does not request persistent/always-on presence or modify other skills. It writes workspace files and params for its own operation only — expected for this functionality.
Assessment
This skill appears to do what it says: local ImageMagick-based iterative image editing with isolated work folders and recorded parameters. Before using it, consider: (1) ImageMagick installation — the skill may prompt the agent/platform to run package-manager commands to install it, so confirm you trust those operations; (2) privacy — the multimodal 'validation' step implies the platform's multimodal model will view intermediate JPGs (which may be uploaded to remote services); avoid processing sensitive images unless you know where multimodal inference runs; (3) filesystem effects — the skill creates workspace directories and writes intermediate JPGs and params (review and clean them if needed); and (4) if you want to audit execution, ask for the exact shell/installation commands the agent will run (the SKILL.md provides magick examples but not install commands). If those points are acceptable, the skill is coherent and proportionate to its stated purpose.

Like a lobster shell, security has layers — review code before you run it.

color-gradingvk9728z5dw47kyhnpgxv1q9rrc583w9ncimage-editingvk9728z5dw47kyhnpgxv1q9rrc583w9ncimagemagickvk9728z5dw47kyhnpgxv1q9rrc583w9nclatestvk9728z5dw47kyhnpgxv1q9rrc583w9ncphotographyvk9728z5dw47kyhnpgxv1q9rrc583w9ncraw-processingvk9728z5dw47kyhnpgxv1q9rrc583w9nc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments