v1.0.0

Ai Image Generation

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:12 AM.

Analysis

This is a straightforward image-generation CLI skill, but it requires installing an external package and using a paid-service API key.

GuidanceThis skill appears coherent for AI image generation. Before installing, verify the ai-media-generator package, use an API key you are comfortable granting to the CLI, confirm the configured base URL, and review credit or quota impact before running generation commands.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

ai-media image generate --model <MODEL> --prompt <PROMPT>

The skill directs the agent/user to run a CLI command that submits image-generation jobs to an external service; this is expected for the stated purpose.

User impactRunning generation commands may consume service quota or paid credits.

RecommendationConfirm the model, prompt, and expected cost or quota use before running image-generation commands.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

install spec

node | package: ai-media-generator | creates binaries: ai-media

The skill relies on an external Node package to provide the executable used by the workflow.

User impactInstalling the package adds third-party code to the local environment.

RecommendationVerify the npm package and homepage match the expected project, and prefer a trusted or pinned version when possible.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

SKILL.md

AI_MEDIA_BASE_URL
        - AI_MEDIA_API_KEY

The skill requires an API key and base URL for the external image service, and also instructs users to configure the key with the CLI.

User impactThe API key can authorize use of the user’s image-generation account and may allow spending credits or using quota.

RecommendationUse a dedicated or limited-scope API key if available, set the base URL only to the intended provider, and avoid exposing the key in chat or logs.