Image Editing

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only image-editing guide; users should notice that optional examples use third-party APIs, API keys, and package installs.

This skill appears safe to install as an instruction-only guide. Before using its examples, decide whether each image is appropriate to send to a cloud provider, keep API keys out of prompts and shared files, watch for provider costs, and install optional local AI packages in an isolated environment.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running those examples may use the user's provider account, consume credits, or incur charges.

Why it was flagged

Several examples rely on provider API credentials for image-editing services. This is expected for these integrations, and the artifacts show placeholders or environment variables rather than hardcoded secrets.

Skill content
client = OpenAI()  # OPENAI_API_KEY env var ... headers={"x-api-key": API_KEY}
Recommendation

Use provider keys only through secure environment variables or secret storage, verify pricing and account scopes, and do not paste real keys into prompts or shared files.

What this means

Private photos, faces, product images, or other sensitive visuals could be transmitted to third-party services if the user chooses those workflows.

Why it was flagged

The workflow demonstrates sending an image file to an external API for background removal. This is disclosed and purpose-aligned, but it means selected images can leave the local device.

Skill content
curl -X POST "https://api.remove.bg/v1.0/removebg" ... -F "image_file=@photo.jpg"
Recommendation

Use local tools for sensitive images when possible, and review each provider's privacy, retention, and billing terms before uploading.

What this means

Installing the optional local tools may run third-party package code and add dependencies to the user's Python environment.

Why it was flagged

The local-tool setup examples install third-party packages without pinned versions. This is common for an instruction guide, but users should trust and isolate those dependencies.

Skill content
pip install iopaint ... pip install rembg[gpu]  # or rembg for CPU ... pip install realesrgan
Recommendation

Install optional tools in a virtual environment, prefer trusted sources, pin versions where practical, and review package documentation before running local services.