Back to skill
Skillv1.3.0
ClawScan security
Image generation and editing · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 29, 2026, 11:50 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requests and instructions match its stated purpose: it needs a Bria API key or device-flow tokens, uses curl to call Bria endpoints, and stores credentials under ~/.bria/credentials — nothing requested looks unrelated to image generation/editing.
- Guidance
- This skill appears coherent for Bria image operations. Before installing, consider: (1) it will read and write tokens in ~/.bria/credentials and may use a BRIA_API_KEY environment variable — verify what is stored there and revoke tokens if you uninstall; (2) images (including base64-encoded image files) will be uploaded to https://engine.prod.bria-api.com — do not send sensitive images you don't want processed externally; (3) the helper creates short-lived files in /tmp — if your environment has strict tmp/data policies, review that behavior; (4) ensure the BRIA_API_KEY you provide has appropriate scope/limits and comes from a trusted Bria account; (5) minor documentation inconsistency: the API docs instruct a User-Agent including a package.json version, but no package.json is bundled — harmless but worth noting. If you trust Bria for processing your images and are comfortable with local token storage, the skill is reasonably proportioned and coherent.
Review Dimensions
- Purpose & Capability
- okName/description (image generation, editing, background removal) align with requested artifacts: BRIA_API_KEY, ~/.bria/credentials, and curl. The code and endpoint docs target Bria API URLs and image-editing endpoints only. Minor note: both an API key env var and an OAuth device flow are supported (the presence of BRIA_API_KEY as primaryEnv is reasonable but slightly redundant if user prefers device flow).
- Instruction Scope
- okSKILL.md and the included shell helper only read ~/.bria/credentials, accept image files/URLs, create short-lived /tmp payload/result files, and POST to engine.prod.bria-api.com (and use platform.bria.ai for device verification). There are no instructions to read other system files, transmit unrelated data, or contact unexpected third-party endpoints.
- Install Mechanism
- okInstruction-only skill (no install spec). The included code examples are shell scripts that rely only on curl/base64/sed and write temporary files to /tmp; no arbitrary downloads or archive extraction are performed.
- Credentials
- okOnly BRIA_API_KEY (primary credential) plus a local credentials file (~/.bria/credentials) are required. Those map directly to the Bria API and the documented device-flow. No unrelated tokens, cloud credentials, or broad secrets are requested.
- Persistence & Privilege
- okalways:false and user-invocable:true (normal). The skill caches tokens under ~/.bria/credentials (expected for OAuth); it does not request system-wide config changes or modify other skills. Autonomous invocation is allowed by default (platform behavior) but not an added privilege of this skill.