Evolink Media — AI Video, Image & Music Generation

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a coherent Evolink media-generation integration, but users should notice that it uses an API key, can upload media files to Evolink, and recommends running an unpinned npm MCP server.

This appears purpose-aligned for AI media generation. Before installing, make sure you trust Evolink and its npm MCP package, consider pinning the MCP package version rather than using @latest, protect your EVOLINK_API_KEY, and only upload media files you are comfortable sending to Evolink.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A future npm package update could change what code runs when the MCP server is launched.

Why it was flagged

The recommended setup runs an external npm MCP package using @latest and -y, so the executed package version can change over time and is not pinned in the skill artifacts.

Skill content
mcporter call --stdio "npx -y @evolinkai/evolink-media@latest" list_models
Recommendation

Install only if you trust the Evolink npm package source; consider pinning a specific package version instead of using @latest.

What this means

Anyone or any process with this key may be able to use the user's Evolink account or consume credits according to the key's permissions.

Why it was flagged

The skill requires an Evolink API key and passes it to the Evolink service/MCP server, which is expected for this integration but still grants account-level service access.

Skill content
requires:\n      env:\n        - EVOLINK_API_KEY
Recommendation

Use a dedicated Evolink API key, keep it private, rotate it if exposed, and monitor account usage.

What this means

Images, audio, or videos selected for generation may be uploaded to Evolink and retained for the stated expiry period.

Why it was flagged

The skill can send local media files to Evolink's file hosting API for generation workflows and discloses temporary retention.

Skill content
Call `upload_file` with `file_path`, `base64_data`, or `file_url`... Files expire after **72 hours**.
Recommendation

Upload only files you intend to share with Evolink, avoid sensitive media unless appropriate, and use the delete-file workflow for files no longer needed.