AI Prompt Reverse Engine

PassAudited by VirusTotal on May 5, 2026.

Overview

Type: OpenClaw Skill Name: prompt-reverse-skill Version: 1.0.0 The skill bundle contains metadata and documentation for an image-to-prompt conversion tool. The SKILL.md and README.md files describe a standard multimodal AI pipeline for analyzing images and generating structured prompts for models like Stable Diffusion and Midjourney. No malicious code, data exfiltration attempts, or prompt injection attacks were identified in the provided files.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If you follow the README setup, you may run code or dependencies that were not reviewed as part of this skill.

Why it was flagged

The README points users to clone and install an external project and requirements file that are not included in the registry artifact. This is manual and not automatically executed, but the referenced code and dependencies are outside the reviewed package.

Skill content

git clone https://github.com/YOUR_USERNAME/prompt-reverse-skill.git  
cd prompt-reverse-skill  

pip install -r requirements.txt

Recommendation

Only follow setup instructions from a real, trusted repository, and inspect the code and requirements before installing or running them.

Note

ASI03: Identity and Privilege Abuse

What this means

A mishandled API key could expose your OpenAI account to unauthorized use or charges.

Why it was flagged

An OpenAI API key is a sensitive account credential. Its use is expected for an OpenAI vision-model workflow, but users should notice that the registry metadata does not declare a required credential.

Skill content

Create a `.env` file:

OPENAI_API_KEY=your_api_key_here

Recommendation

Use a limited-scope key if possible, keep it out of chat transcripts and public files, and monitor provider usage.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Private or sensitive images could be sent to an external provider if the README-described implementation is used.

Why it was flagged

The documented workflow implies image content may be processed through an external AI provider. This is aligned with the skill's purpose, but the artifacts do not specify data retention, privacy boundaries, or exact transfer behavior.

Skill content

- Analyzes images using a vision model  
- OpenAI API

Recommendation

Avoid using sensitive images unless you trust the provider and implementation, and review the provider's data-use policy.