AI Image Generator
Security checks across malware telemetry and agentic risk
Overview
This skill appears to do what it says—generate images through YouMind—but it requires a YouMind API key, uses an external CLI, may run short background polling, and saves results to a YouMind board.
Install this only if you trust YouMind and its CLI. Configure the API key outside chat, verify the npm package before global installation, avoid sensitive image prompts, and remember that generated images are saved to your YouMind board.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill can use the configured YouMind account to generate and save images.
The skill requires a YouMind API key so the agent can call the user's YouMind account through the CLI.
primaryEnv: YOUMIND_API_KEY ... requires: ... env: ["YOUMIND_API_KEY"]
Use an API key you trust for this purpose, configure it outside chat, and revoke or rotate it if you stop using the skill.
Installing the CLI changes the local/global npm environment and depends on the npm package being trustworthy.
The setup path installs an external npm CLI globally and does not pin a specific package version.
npm install -g @youmind-ai/cli
Verify the npm package and publisher before installing, and consider pinning or reviewing the CLI version in managed environments.
The agent may run local commands as part of the image-generation workflow.
The skill allows local command execution for the YouMind CLI and Node helpers. This is mostly purpose-aligned, but `node -e *` is broader than the visible extraction script requires.
allowed-tools:\n - Bash(youmind *)\n - Bash(npm install -g @youmind-ai/cli)\n - Bash(node -e *)\n - Bash(node scripts/*)
Limit use to the documented YouMind commands and `scripts/extract-images.js`; avoid arbitrary `node -e` execution unless the user explicitly approves.
Prompts and generated image results may become part of the user's YouMind workspace.
The skill persists generated outputs in the user's YouMind board rather than keeping them only in the local chat.
Generated images are saved to your YouMind board automatically.
Avoid sensitive prompts or private content unless you are comfortable storing the result in YouMind.
The agent may continue checking image status briefly after returning control to the main chat.
The skill may delegate polling to a background task, but the visible instructions bound it to the image-generation chat and a 60-second timeout.
spawn a subagent/background task for the polling work. Return control to the user immediately ... Timeout: 60 seconds
Use background polling only for the documented chat status check, keep the timeout, and notify the user when complete.