Creatok Generate Image
Analysis
The skill mostly matches its CreatOK image-generation purpose, but it needs review because an unvalidated run ID can redirect where local result files are written.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
function artifactsForRun(skillDir, runId) { return new Artifacts(path.join(artifactsRootForSkill(skillDir), runId)); }The runId value is joined directly into the artifact path without validation; scripts/run.js accepts --run_id as an argument, so traversal values could redirect result.json/result.md writes outside the intended .artifacts directory.
const file = await fs.readFile(filePath); ... await fetch(upload.presignedUploadUrl, { method: 'PUT', headers: { 'Content-Type': fileType }, body: file })The client reads a local reference image and uploads it to a CreatOK-provided presigned URL; SKILL.md discloses that reference images are uploaded before generation.
if (key === '--yes') { args.yes = true; } ... if (!resolvedArgs.yes) { const confirmed = await confirmGeneration(resolvedArgs); ... }The default CLI path asks for confirmation, but --yes skips the interactive prompt. This is usable for already-confirmed workflows, but matters because image generation may consume credits.
Source: unknown; Homepage: none; Registry metadata Version: 0.1.3; SKILL.md version: "1.0.0"
The registry provenance fields are incomplete and the packaged metadata version does not match the SKILL.md frontmatter version, which makes origin and update verification less clear.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
const apiKey = process.env.CREATOK_API_KEY; ... baseUrl: 'https://www.creatok.ai', openSkillsKey: String(apiKey)
The skill requires a CreatOK API key from the environment and uses it for authenticated CreatOK API calls; this is expected for the integration but grants account/API authority.