Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Stock Images

Source free stock photos and placeholder images with direct URLs for Unsplash, Pexels, Pixabay, and Lorem Picsum.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
1 · 410 · 5 current installs · 5 all-time installs
byIván@ivangdavila
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description (source free stock photos and placeholders) matches the files and instructions: URL patterns for Lorem Picsum, Unsplash, Pexels, Pixabay, Placehold.co, etc. There are no unrelated environment variables, binaries, or install steps requested.
Instruction Scope
SKILL.md and the referenced files only instruct the agent to return or construct direct image URLs and optionally store a local memory.md if the user asks. They instruct loading local reference files (setup.md, unsplash-categories.md). The README claims "No user data sent," but any HTTP request to external image hosts will inevitably include network metadata (IP address, request headers and possibly Referer) — this is normal for hotlinking and not hidden in the skill, but users should be aware.
Install Mechanism
No install spec and no code files — instruction-only. This is the lowest-risk install model (nothing written to disk by an installer).
Credentials
The skill requires no environment variables, credentials, or config paths. The absence of secrets is proportionate to a URL/reference skill. Note: making image requests contacts third-party hosts and can expose network-level metadata (IP/headers).
Persistence & Privilege
always:false and standard autonomous invocation are used (normal). The only persistence suggested is an optional local memory file saved only if the user requests it; the skill does not request elevated privileges or modify other skills.
Assessment
This skill is coherent and lightweight: it only supplies ready-to-use image URL patterns and optional local preference saving. Before installing or using it, consider: (1) Network/privacy — fetching images from external hosts will reveal your IP and request headers to those hosts (normal for hotlinking). (2) Licensing — verify license/attribution for production use even though many services permit casual use. (3) Stability — direct source URLs (e.g., source.unsplash.com) may redirect or change; if you need consistency, cache the final image URL or use IDs. (4) If you need higher request volume, attribution, or guaranteed terms, prefer the official APIs (which require keys) rather than anonymous hotlinking. If these tradeoffs are acceptable, the skill is fine to install.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk973kq49796rdwxqr7wkmfxp4581vd4q

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

📸 Clawdis
OSLinux · macOS · Windows

SKILL.md

Setup

On first use, read setup.md silently. No setup needed for basic use.

When to Use

User needs stock photos or placeholder images for mockups, prototypes, websites, or presentations. Agent provides direct URLs without API keys when possible.

Architecture

No persistent storage needed. Reference files loaded on demand.

Quick Reference

TopicFile
Setupsetup.md
Memory templatememory-template.md
All providers with examplesproviders.md
Unsplash category URLsunsplash-categories.md

Core Rules

1. Prefer Direct URL Services

For quick mockups and prototypes, use services that work without API keys:

  • Lorem Picsum — random photos by size
  • Placehold.co — colored placeholders with text
  • PlaceKeanu — Keanu Reeves placeholder photos
  • Unsplash Source — direct links to Unsplash photos

2. Match Content to Context

NeedBest Source
Generic photo placeholdersLorem Picsum, Unsplash Source
Specific subjects (business, nature)Unsplash, Pexels, Pixabay
Colored boxes with dimensionsPlacehold.co
Avatars/facesUI Faces, This Person Does Not Exist
IconsIconify, Feather Icons

3. Know the URL Patterns

Quick patterns that work immediately:

# Lorem Picsum - random photo at size
https://picsum.photos/800/600

# Lorem Picsum - specific image by ID
https://picsum.photos/id/237/800/600

# Lorem Picsum - grayscale
https://picsum.photos/800/600?grayscale

# Placehold.co - gray placeholder with text
https://placehold.co/800x600

# Placehold.co - custom colors
https://placehold.co/800x600/000/fff

# Unsplash Source - specific search
https://source.unsplash.com/800x600/?nature

# PlaceKeanu - with size
https://placekeanu.com/800/600

4. Use Cached URLs for Consistency

When building prototypes that need consistent images across sessions:

  • Use id parameter in Lorem Picsum
  • Save specific Unsplash photo URLs
  • Use ?random=1 only when variety is needed

5. Respect Licensing

ServiceLicenseAttribution
UnsplashUnsplash LicenseNot required but appreciated
PexelsPexels LicenseNot required
PixabayPixabay LicenseNot required
Lorem PicsumVariousPhotos from Unsplash

For commercial projects, verify license on original photo page.

6. Load Category Index for Specific Needs

When user needs specific subjects (business people, landscapes, food), load unsplash-categories.md for curated URLs by category.

7. Optimize for Performance

  • Use WebP format when supported: https://picsum.photos/800/600.webp
  • Use exact dimensions needed (no oversized images)
  • For retina: Placehold.co supports @2x and @3x

Common Traps

  • Using random URLs in production without caching → inconsistent images
  • Hotlinking without checking terms → service blocks requests
  • Using placeholder services for final production → unprofessional
  • Requesting too large images → slow load times

External Endpoints

EndpointData SentPurpose
picsum.photosImage dimensionsRandom photo
placehold.coDimensions, colors, textPlaceholder image
source.unsplash.comSearch termsUnsplash photos
placekeanu.comDimensionsKeanu placeholder

No authentication required. No user data sent.

Security & Privacy

Data that leaves your machine:

  • HTTP requests with dimensions and optional search terms

Data that stays local:

  • Cached images in browser
  • No tracking, no API keys needed

This skill does NOT:

  • Store credentials
  • Track usage
  • Require API registration

Related Skills

Install with clawhub install <slug> if user confirms:

  • image — image analysis and manipulation
  • image-generation — AI image generation
  • frontend — frontend development
  • design — design principles
  • ui — UI design patterns

Feedback

  • If useful: clawhub star stock-images
  • Stay updated: clawhub sync

Files

5 total
Select a file
Select a file to preview.

Comments

Loading comments…