Eachlabs Workflows

Build and orchestrate multi-step AI workflows combining multiple EachLabs models. Create custom pipelines, trigger executions, and manage workflow versions....

Security Scan

The skill's runtime instructions largely match an EachLabs workflow API, but the registry metadata omits the API key requirement and the source/homepage is unknown — this mismatch and lack of provenance are concerning.

Purpose & Capability

The name/description (build and orchestrate EachLabs workflows) aligns with the SKILL.md examples and API endpoints. Examples reference many third‑party models (ElevenLabs, ffmpeg, Bytedance) which is consistent with a workflow orchestrator that chains heterogeneous models.

Instruction Scope

The instructions are explicit about HTTP calls to workflows.eachlabs.run and ask the agent user to set EACHLABS_API_KEY and include it in X-API-Key headers. The instructions do not ask the agent to read unrelated local files or secret stores. They do allow use of user-specified webhook URLs (which will send execution outputs to whichever endpoint the user configures).

Install Mechanism

No install spec and no code files — instruction-only. That minimizes on-disk risk because nothing is automatically downloaded or executed on the host.

Credentials

The SKILL.md requires an EACHLABS_API_KEY for API calls, but the registry metadata lists no required environment variables or primary credential. That mismatch is an incoherence that could be an oversight, but it matters: the skill will expect an API key (network egress) despite the published metadata not declaring any secret requirement. Also some example steps reference third-party providers which may need additional credentials not declared here.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request permanent agent presence or modify other skill configs. Autonomous invocation remains possible (default), but that alone is not a flag in this assessment.

What to consider before installing

What to consider before installing: - The SKILL.md requires an EACHLABS_API_KEY (X-API-Key) but the registry metadata does not declare any required environment variables — ask the publisher why the API key was omitted from metadata before trusting the skill. Treat this as an inconsistency rather than proof of malice. - The skill makes outbound HTTP requests to workflows.eachlabs.run (and references api.eachlabs.ai). There are no files to install locally, but the skill will cause network requests that can transmit inputs/outputs. Only provide a dedicated EachLabs key with minimal scope and usage limits (not a highly privileged or multi-service key). - Examples reference third-party models (elevenlabs, ffmpeg, bytedance). These may require separate credentials or call external services; confirm which credentials are actually needed and never reuse high-privilege keys (AWS, GCP, etc.). - Webhooks: workflows can POST results to any webhook_url you provide. Only point webhooks to endpoints you control and monitor for unexpected data exfiltration. - Provenance: the registry entry lacks a homepage and source. Verify the official EachLabs documentation (eachlabs.ai) and confirm the described endpoints and domains match the legitimate service. If you cannot confirm provenance, prefer not to provide real credentials and test in an isolated environment. - If you proceed: use a throwaway or scoped API key, monitor API usage and logs, and restrict webhook endpoints. If the publisher can update metadata to explicitly declare EACHLABS_API_KEY and provide a homepage/source, that would reduce this concern.

Build, manage, and execute multi-step AI workflows that chain multiple models together via the EachLabs Workflows API.

Authentication

Header: X-API-Key: <your-api-key>

Set the EACHLABS_API_KEY environment variable. Get your key at eachlabs.ai.

Base URL

https://workflows.eachlabs.run/api/v1

Building a Workflow

To build a workflow, you must: (1) create the workflow, then (2) create a version with the steps.

Step 1: Create the Workflow

curl -X POST https://workflows.eachlabs.run/api/v1/workflows \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $EACHLABS_API_KEY" \
  -d '{
    "name": "Product Photo to Video",
    "description": "Generate a product video from a product photo"
  }'

This returns a workflowID. Use it in the next step.

Step 2: Create a Version with Steps

curl -X POST https://workflows.eachlabs.run/api/v1/workflows/{workflowID}/versions \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $EACHLABS_API_KEY" \
  -d '{
    "description": "Initial version",
    "steps": [
      {
        "name": "enhance_photo",
        "model": "gpt-image-v1-5-edit",
        "version": "0.0.1",
        "input": {
          "prompt": "Place this product on a clean white background with studio lighting",
          "image_urls": ["{{inputs.image_url}}"],
          "quality": "high"
        }
      },
      {
        "name": "create_video",
        "model": "pixverse-v5-6-image-to-video",
        "version": "0.0.1",
        "input": {
          "image_url": "{{steps.enhance_photo.output}}",
          "prompt": "Slow cinematic rotation around the product",
          "duration": "5",
          "resolution": "1080p"
        }
      }
    ]
  }'

Important: Before adding a model to a workflow step, check its schema with GET https://api.eachlabs.ai/v1/model?slug=<slug> to validate the correct input parameters.

Step 3: Trigger the Workflow

curl -X POST https://workflows.eachlabs.run/api/v1/{workflowID}/trigger \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $EACHLABS_API_KEY" \
  -d '{
    "inputs": {
      "image_url": "https://example.com/product.jpg"
    }
  }'

Step 4: Poll for Result

curl https://workflows.eachlabs.run/api/v1/executions/{executionID} \
  -H "X-API-Key: $EACHLABS_API_KEY"

Poll until status is "completed" or "failed". Extract output from step_outputs.

Workflow Management

List Workflows

curl https://workflows.eachlabs.run/api/v1/workflows \
  -H "X-API-Key: $EACHLABS_API_KEY"

Get Workflow Details

curl https://workflows.eachlabs.run/api/v1/workflows/{workflowID} \
  -H "X-API-Key: $EACHLABS_API_KEY"

Bulk Trigger

Trigger the same workflow with multiple inputs:

curl -X POST https://workflows.eachlabs.run/api/v1/{workflowID}/trigger/bulk \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $EACHLABS_API_KEY" \
  -d '{
    "executions": [
      { "inputs": { "image_url": "https://example.com/product1.jpg" } },
      { "inputs": { "image_url": "https://example.com/product2.jpg" } },
      { "inputs": { "image_url": "https://example.com/product3.jpg" } }
    ]
  }'

Check Execution Status

curl https://workflows.eachlabs.run/api/v1/executions/{executionID} \
  -H "X-API-Key: $EACHLABS_API_KEY"

Response includes status (pending, running, completed, failed) and step_outputs with results from each step.

Webhooks

Configure a webhook to receive results asynchronously:

curl -X POST https://workflows.eachlabs.run/api/v1/{workflowID}/trigger \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $EACHLABS_API_KEY" \
  -d '{
    "inputs": { "image_url": "https://example.com/photo.jpg" },
    "webhook_url": "https://your-server.com/webhook"
  }'

Version Management

Workflow versions allow you to iterate on workflows while keeping previous versions intact. Steps are defined in versions, not in the workflow itself.

Create a Version

curl -X POST https://workflows.eachlabs.run/api/v1/workflows/{workflowID}/versions \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $EACHLABS_API_KEY" \
  -d '{
    "description": "Added upscaling step",
    "steps": [
      {
        "name": "generate_image",
        "model": "gpt-image-v1-5-text-to-image",
        "version": "0.0.1",
        "input": {
          "prompt": "{{inputs.prompt}}",
          "quality": "high"
        }
      },
      {
        "name": "upscale",
        "model": "topaz-upscale-image",
        "version": "0.0.1",
        "input": {
          "image_url": "{{steps.generate_image.output}}"
        }
      }
    ]
  }'

Get a Version

curl https://workflows.eachlabs.run/api/v1/workflows/{workflowID}/versions/{versionID} \
  -H "X-API-Key: $EACHLABS_API_KEY"

Update a Version

curl -X PUT https://workflows.eachlabs.run/api/v1/workflows/{workflowID}/versions/{versionID} \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $EACHLABS_API_KEY" \
  -d '{
    "description": "Updated prompt template",
    "steps": [
      {
        "name": "generate_image",
        "model": "gpt-image-v1-5-text-to-image",
        "version": "0.0.1",
        "input": {
          "prompt": "Professional photo: {{inputs.prompt}}",
          "quality": "high"
        }
      }
    ]
  }'

List Versions

curl https://workflows.eachlabs.run/api/v1/workflows/{workflowID}/versions \
  -H "X-API-Key: $EACHLABS_API_KEY"

Workflow Features

• Two-phase creation: Create workflow first, then add steps via versions
• Step chaining: Reference previous step outputs with {{steps.step_name.output}}
• Input variables: Use {{inputs.variable_name}} to pass dynamic inputs
• Version management: Create, update, and retrieve workflow versions
• Bulk execution: Process multiple inputs in a single API call
• Webhook support: Get notified when executions complete
• Public/unlisted sharing: Share workflows with others

Example Workflow References

See references/WORKFLOW-EXAMPLES.md for common workflow patterns.