Cheapest Image Generation

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward EvoLink image-generation skill; the main things to notice are that it uses your EvoLink API key, sends prompts to EvoLink, and saves the generated image locally.

This looks benign and purpose-aligned. Before installing, make sure you trust EvoLink with your prompts, store the API key securely, and remember that using the trigger phrases can spend provider credits and leave generated image files on disk.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Generated images may consume EvoLink credits or be associated with the user's EvoLink account.

Why it was flagged

The skill requires a provider API key and uses it for authenticated EvoLink image-generation requests. This is purpose-aligned, but it is still account authority.

Skill content

`EVOLINK_API_KEY` env var (required)

Recommendation

Use a dedicated EvoLink key where possible, keep it in the environment/secret store rather than pasting it into chats, and monitor provider usage.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any sensitive information included in an image prompt would be shared with the EvoLink service.

Why it was flagged

The user's image prompt is sent to the EvoLink API. The endpoint is clearly disclosed and this is necessary for the skill, but it is an external data flow.

Skill content

Base: `https://api.evolink.ai/v1` ... `"prompt": "<USER_PROMPT>"`

Recommendation

Avoid putting secrets, private personal data, or confidential business details in prompts unless you are comfortable sending them to EvoLink.

Info

#ASI02: Tool Misuse and Exploitation

What this means

A matching request can consume API credits and save an image file locally.

Why it was flagged

The skill may call the external image-generation API immediately when the user uses the documented trigger phrasing. This matches the skill's purpose but can create provider activity and a local file without an extra confirmation step.

Skill content

Treat the text after the colon as `prompt`, use default size `1:1`, generate immediately.

Recommendation

Invoke the trigger phrases only when you intend to generate an image, and check the saved output path if you need to manage local files.