Moark Image Gen

ReviewAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward image-generation skill, but it uses a Gitee AI API key and sends prompts to that external service.

Before installing, make sure you trust using Gitee AI for your prompts, set GITEEAI_API_KEY securely, avoid sensitive prompt content, and install the Python dependency in an isolated environment if possible.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing a Python package can affect the local environment if done globally or from an untrusted package source.

Why it was flagged

The skill relies on an external Python dependency installed by the user. This is expected for the image API client, but the dependency source/version is not pinned by the artifacts.

Skill content

Ensure you have installed the required dependencies (`pip install openai`). Use the bundled script to generate images.

Recommendation

Install the dependency from a trusted package index, preferably in a virtual environment, and review the installed package/version if your environment is sensitive.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The API key may allow image-generation usage or charges on the associated Gitee AI account.

Why it was flagged

The script uses a Gitee AI API key supplied by argument or environment variable to authenticate to the external provider, which is expected for this service.

Skill content

api_key = get_api_key(args.api_key) ... base_url="https://ai.gitee.com/v1", api_key=api_key

Recommendation

Use a scoped or dedicated API key where possible, prefer the environment variable over pasting keys into shared command history, and rotate the key if it is exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any private or sensitive details included in the prompt may be processed by the external image-generation provider.

Why it was flagged

The user prompt and generation parameters are sent to the configured external Gitee AI-compatible API to produce an image URL.

Skill content

response = client.images.generate(
            prompt=args.prompt,
            model=args.model,
            size=args.size,
            extra_body=extra_body,
        )

Recommendation

Avoid putting secrets, confidential business details, or sensitive personal information in image prompts unless you are comfortable sharing them with Gitee AI.