v0.1.0

ImageRouter

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:16 AM.

Analysis

ImageRouter is an instruction-only image generation skill that uses curl and an ImageRouter API key in a purpose-aligned way, with a few normal privacy and credential-handling points to notice.

GuidanceThis skill appears coherent and purpose-aligned. Before installing or using it, be aware that it sends prompts and any selected input images to ImageRouter and uses your API key, which may incur usage costs. Avoid uploading private images unless you are comfortable with the provider handling them.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

-F 'image[]=@/path/to/your/image.webp'

The skill documents curl commands that upload local image files to ImageRouter for image-to-image generation. This is purpose-aligned, but it is a transfer of local user files to an external service.

User impactImages selected for editing may be sent to ImageRouter and processed or hosted according to the provider's behavior.

RecommendationOnly upload images you intend to share with ImageRouter, and use privacy-preserving response formats where appropriate.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

-H 'Authorization: Bearer YOUR_API_KEY'

The skill instructs use of an ImageRouter API key. This is expected for the service and is disclosed, but it gives the agent access to make API calls under the user's account.

User impactUsing the skill may consume ImageRouter credits or otherwise act under the user's API account.

RecommendationUse a dedicated or limited-scope API key if available, monitor usage, and do not paste real keys into shared transcripts or logs.