Evez Api Gateway

AdvisoryAudited by Static analysis on May 12, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Installing or using this skill may cause your agent or code to use an EVEZ account key, which can consume quota or incur charges depending on your plan.

Why it was flagged

The helper client uses an API key to authenticate to the EVEZ endpoint. This is expected for the skill's purpose, but it is a sensitive credential and the registry metadata does not declare a primary credential or required env var.

Skill content

self.api_key = api_key or os.environ.get("EVEZ_API_KEY", "")
self.client = OpenAI(base_url=BASE_URL, api_key=self.api_key)

Recommendation

Use a dedicated EVEZ API key, avoid reusing unrelated OpenAI keys, and confirm which environment variable your workflow should use.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Prompts, system messages, and vision image URLs sent through this client are shared with the EVEZ service.

Why it was flagged

The client sends chat messages to the external EVEZ API endpoint. This is purpose-aligned, but it means prompt content leaves the local environment.

Skill content

BASE_URL = "https://evez-api2.fly.dev/v1"
response = self.client.chat.completions.create(
    model=model_id, messages=messages, stream=stream
)

Recommendation

Review EVEZ's privacy and retention policies before sending confidential data, secrets, private images, or regulated information.