blog-image-embedder

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears purpose-aligned: it reads a blog markdown file, uses a configured model to create image prompts, and saves an illustrated markdown copy.

This looks safe for its intended blog workflow. Check that the configured directory contains the correct markdown file, and avoid using it on confidential drafts unless you are comfortable sending prompt-relevant content to the selected model provider.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill may process the newest markdown file in the configured output directory, so an unintended draft could be used if that directory contains multiple files.

Why it was flagged

The workflow uses shell-style file listing and reading to select and load markdown content. This is consistent with the stated purpose, but it may choose the latest file in outputDir rather than only a user-specified path.

Skill content
polishedPath="$(ls -t "$outputDir"/*.md | head -n 1)" ... markdownContent="$(cat "$polishedPath")"
Recommendation

Before running it, confirm outputDir and polishedPath point to the intended blog file.

What this means

Private or unpublished blog content could be exposed to the selected model provider during prompt generation.

Why it was flagged

The skill uses an LLM/image model flow to parse sections and generate image prompts. This is central to the skill, but it means blog titles, summaries, or prompt content may be sent to the configured model provider.

Skill content
parse_sections ... llm: true ... generate_prompts ... image: true ... model: ${imageModel}
Recommendation

Use this only with content suitable for the configured provider, and review provider/privacy settings if the blog draft is sensitive.