AI写真助手

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears purpose-aligned for AI photo service support, but it uses a DeepSeek API key and sends user prompts to DeepSeek.

This looks like a small, coherent AI photo customer-service helper. Before using it, confirm that you are comfortable with it using your DeepSeek API key and sending your prompts to DeepSeek, and avoid sharing sensitive personal information.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill may consume the user's DeepSeek account quota or billing credits.

Why it was flagged

The helper uses a DeepSeek API key from the environment or local OpenClaw provider config. This is consistent with DeepSeek-powered replies, but it can use the user's provider credential and API quota.

Skill content

let KEY = process.env.DEEPSEEK_API_KEY || ''; ... readFileSync(path.join(process.env.HOME,'.openclaw/openclaw.json'),'utf8')); KEY = KEY || c.models?.providers?.deepseek?.apiKey || '';

Recommendation

Only use it if you are comfortable with the skill using your DeepSeek key; the publisher should declare this credential requirement clearly.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Questions or text provided to the helper may be transmitted to DeepSeek.

Why it was flagged

User prompts are sent to DeepSeek's chat completion API. This external provider use is aligned with the stated DeepSeek AI reply feature.

Skill content

messages:[{role:'system',content:'你是AI写真馆的小龙虾客服...'}, {role:'user',content:prompt}] ... https.request({hostname:'api.deepseek.com',path:'/v1/chat/completions'

Recommendation

Avoid entering private or sensitive information unless you are comfortable sharing it with the DeepSeek provider.