Cheapest Image

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it claims: generate images through EvoLink, while using your EvoLink API key and sending prompts to EvoLink.

Install if you are comfortable using an EvoLink API key and sending image prompts to EvoLink. Use a dedicated or easily revocable key, avoid putting sensitive data in prompts, and remember that each generation may consume API credits.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using the listed trigger phrases may send the prompt to EvoLink and consume API credits right away.

Why it was flagged

The skill directs the agent to call the image-generation workflow immediately after matching trigger phrases. This fits the stated purpose, but users should know it can initiate paid API usage without a separate confirmation prompt.

Skill content

Treat the text after the colon as `prompt`, use default size `1:1`, generate immediately.

Recommendation

Use clear, intentional trigger phrases and confirm your agent behavior if you want an extra approval step before paid generations.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use your EvoLink account/API credits for image generation.

Why it was flagged

The script reads the EvoLink API key and uses it as a bearer token for EvoLink API requests. This is expected for the service integration, but it is still delegated account access.

Skill content

default=os.getenv("EVOLINK_API_KEY", "") ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated or revocable EvoLink key, prefer the environment variable over pasting keys into commands or chats, and rotate the key if it is exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Anything included in an image prompt may be transmitted to EvoLink.

Why it was flagged

The user's image prompt is included in the payload sent to EvoLink's external API. This is necessary for image generation, but it means prompt contents leave the local environment.

Skill content

API_BASE = "https://api.evolink.ai/v1" ... "prompt": args.prompt

Recommendation

Do not include secrets, private personal information, or confidential business details in prompts unless you are comfortable sharing them with EvoLink.